{ "Event": { "published": true, "date": "2026-06-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-16", "timestamp": 1781654582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "34e3ef90-7e5f-439d-8ad5-65baf1beb2e6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb277292-696b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781604684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604684, "uuid": "5993d80d-a66a-4edb-a18d-b9531710c17b", "comment": "Malware payload (Mirai)", "value": "7d5e1e5eb67edbfbcc4e3c5472cfa5e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604684, "uuid": "d416425f-634a-4677-ba0f-d46bcce161aa", "comment": "Malware payload (Mirai)", "value": "00be47d111b0acc4a5876b836dfd4eefbe164c61e061bd239f27610a6a5756fa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604684, "uuid": "823e5dd3-418e-4204-aedf-f7569d432a65", "comment": "Malware payload (Mirai)", "value": "0b88da38551fb7012612ef04e4fb5741eddf85f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604684, "uuid": "a657dcea-76c1-4343-84a4-878c66b2eb48", "comment": "Malware payload (Mirai)", "value": "f27e6f24641dc68ec545bfc5851acb54bd041121ce3dd99920498cc67a5c45c0080427703520722681004a861a017eae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604684, "uuid": "117eb300-c6eb-4ed0-962a-e553d199d3d6", "value": "T1BFE30945FC509B23C6D7267BFB4E428D772A07A8D3EE720389255F21379A95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604684, "uuid": "31be0bea-c5e4-4d98-b2df-c489405c7993", "value": "1536:catAnyKfjMg6hA+u+EatKs2el7AB4sqADsBBTyjsSTf4OKveDWPjrDylp4wyw6em:c5n9fjMsnLsVl7xA+B0sOCeavFn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604684, "uuid": "84b15c13-2c6a-4a7f-be7b-3da6d625ffe4", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604684, "uuid": "a9af7cbd-0550-4892-808b-1ccabc6f344f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604684, "uuid": "fcd8134f-4237-43dd-8258-6ea0c90c624d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8396cc1-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781608652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608652, "uuid": "3ae24063-50fb-4cbe-8256-c108c3691ca7", "comment": "Malware payload (Gafgyt)", "value": "397e702901fe20b3cb108f7a6a527416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608652, "uuid": "619fca3e-a0c0-47d0-9d97-d38aabefed31", "comment": "Malware payload (Gafgyt)", "value": "01b79d849af474b20157d3af51257e27bca7fce8b08a17c3202c458fabcd781c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608652, "uuid": "c02f5314-4899-4d4b-b853-d87441ba5bbf", "comment": "Malware payload (Gafgyt)", "value": "fbcc921b4b9b2d7d85fdfca4951eff015c8c87e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608652, "uuid": "9e496559-f35a-4b71-a9c1-a6ff875a4cc0", "comment": "Malware payload (Gafgyt)", "value": "bea0a4f7d61b5b6f337133bad920df36336d17835dcc030b6e4b938915f2757c7237e7c692ea19505e7cf1d2b431d9f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608652, "uuid": "7e2fecad-ab03-4731-8412-a8942003c3a0", "value": "T19F74A623D8154595D1614CF322273389AD0B87BF89E732D3EE2A59A0BF6051F52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608652, "uuid": "5e388193-2068-4697-a639-767e5d056f76", "value": "3072:sbgQxdnFjImmejjPKwjoCU9ObmAUmE/9aQaSXRigRNb:mrIm93iwjoz9OemE/9aQaSXRigRNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608652, "uuid": "b92e7df9-d886-4c1d-bd53-406763e696ad", "value": 352457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608652, "uuid": "627180fc-dbd3-43d8-9770-53134c901179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608652, "uuid": "d33e9935-b7bc-468b-a464-575b8a3ea4ea", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520a42f8-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781607514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607514, "uuid": "4fdb5f0c-1c8b-4575-a9e8-b60979159c11", "comment": "Malware payload (Kimsuky)", "value": "07e3a080e62bac919314e4191b84c7c7", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607514, "uuid": "e7674233-55a1-4d9f-9741-35637698b4c2", "comment": "Malware payload (Kimsuky)", "value": "025c3478466a3aea81532cf984dfa8fc352ba9d5eae68ca2f4c36088ed2e8dc5", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607514, "uuid": "33318659-c587-4a5e-8bad-7c8456e0174e", "comment": "Malware payload (Kimsuky)", "value": "6abdaafa5be147d19634b9aacfb85fc9391d2522", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607514, "uuid": "9f97c971-52c0-4ccf-9bba-f17f48f5103e", "comment": "Malware payload (Kimsuky)", "value": "3ee0f5424965a048e6ce10e8e1652af478af0986678f90829a43a520042c51e5d48caa18a6945d3d3df2bb88b6c2035a", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607514, "uuid": "1ad223ba-ebfd-40a3-ae1c-3c3133ed187b", "value": "T12713A79B9519C2C63B7022AB17EBE5D73A04CC6900A5CF86F4BF8C3E7315819726871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607514, "uuid": "64b21bfe-18d2-4d40-8bfa-76b210bd2532", "value": "768:rsFFTMGvCXKN+lm4RZakgxrkohRw2Rx+Jgmx0+oN+LqaLRxBDp87fuFysdd4ScaE:5pkrXw2Rx+Jgmx0+oNexRDOeRQai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607514, "uuid": "7128492d-a0a7-43af-b7ea-bb80668d9e65", "value": 42726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607514, "uuid": "f6cb0723-28eb-4a05-9fec-154b72215743", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607514, "uuid": "20bff086-9cd6-4b5a-b905-c93d69b6bf7a", "value": "145mbgyb.jrd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362b402d-697c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781611763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611763, "uuid": "4e8ec845-4ba8-42a4-bb0f-39bb820c0a65", "comment": "Malware payload (RemcosRAT)", "value": "a7b122fcda630a745cf0fd28a687f406", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611763, "uuid": "ae8ec199-e505-4e6a-b871-8b269144011b", "comment": "Malware payload (RemcosRAT)", "value": "026a62925a01889c0ee7a454cdaccc99c557eda539d0dec7e0c598a025ec3874", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611763, "uuid": "04663fa9-ae8e-4518-9ccd-710770a8729c", "comment": "Malware payload (RemcosRAT)", "value": "cc773dda757e5c620464875172ec6aa79d1b8654", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611763, "uuid": "83b8a9bd-80cf-40a8-b856-6425ae759e84", "comment": "Malware payload (RemcosRAT)", "value": "e5d03f9186fcafa297034c08a19e9fbc5da7bb9178234a3091d1c722bdaa02ab186554deefbd99e26740c8290a639e68", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611763, "uuid": "7e7cd462-a598-4354-8451-fdb1a098e10f", "value": "T1D7D40151F594990BDF0A4F398BD39AE61A11FCA1582B960F714133AE2EF3AD16D13C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611763, "uuid": "8003d317-d011-4dc8-9d06-f5944f79af1d", "value": "12288:uLH4jiHi9PQvUJ2nYlXc3VCPj8om7p4L1GM:uLHiiC94vU1F8FV4hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611763, "uuid": "c6bbf1c0-807a-4f20-855b-9442d92c03ba", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611763, "uuid": "36e95c8f-6732-4718-aa0f-68aacc4a98a1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611763, "uuid": "6d4a6199-140e-4047-bc1d-225f5cfddf0a", "value": "Thermo Fisher_RFQ_TFS-1705.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3d2dd0-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625674, "uuid": "bd230821-bd97-4505-bda2-7bf691c65859", "comment": "Malware payload (Mirai)", "value": "7883d903099a050c4b7faf676eb422d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625674, "uuid": "86b43ad3-6924-4228-91b7-235f822675a9", "comment": "Malware payload (Mirai)", "value": "0286a2b15bca44bb27a6a4da44c46f31ad96ff307d9fe68d92e4b22aec8345b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625674, "uuid": "5f828acc-29ea-4bf8-9e88-48fec63c206b", "comment": "Malware payload (Mirai)", "value": "9c42ae202b9921b3eeafb13181358f1a9ab3943d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625674, "uuid": "dc3da931-df1d-4266-a532-0361355cfc05", "comment": "Malware payload (Mirai)", "value": "222fbe6673f1761f8797cbb5d452198af108ad4d64908b6ad6ff01c93e24ef91dbfd41766efa636e0c8cf54b0a3325a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625674, "uuid": "007e5aad-7121-4a85-a665-81d275e8f8d7", "value": "T19A23F882B8929907C6E4137BFA6E418D332663A8E1DF3217DD222F1177D692F0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625674, "uuid": "22a539f3-1905-4ed9-9cc5-32c2b4a1874b", "value": "768:863B3LWhY1DYNzSBmK0E+6AKpePjBEoSrBlkHHqvO5hnyeoYUPNudJorVRHN:VB3N8NG5ONSrInyKcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625674, "uuid": "178c843f-2a0f-49f2-a3c0-4c0e14a8a2ce", "value": 45892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625674, "uuid": "6aaa8aa6-345b-4208-a49c-9350fb897118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625674, "uuid": "1cfb5bba-72b6-4915-a672-489c807ed5b6", "value": "eac594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c25fc9f-69d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781649971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649971, "uuid": "3eeadf47-bd52-461e-856b-df7e8591bf10", "comment": "Malware payload (Mirai)", "value": "31c8e5984b1e38b489956cd230ad9781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649971, "uuid": "f621f78e-af99-4c58-bbb4-a86c0bd9f8f0", "comment": "Malware payload (Mirai)", "value": "02f64b80d027326ea2eeefba2aac3e3c7982a58c715d3eee738bd8c9deb03fab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649971, "uuid": "3134f13e-a07b-45f1-9792-ce789f735389", "comment": "Malware payload (Mirai)", "value": "a57a764d8d9f94ef55dcb714974a4512d854122e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649971, "uuid": "5b46ab41-267f-4cbc-93e1-126c79caec9d", "comment": "Malware payload (Mirai)", "value": "1e1139bef7b5168b64a92a945df8707d0b62c8bc56a9f73f1cd57d0c8717f41319b2d57f26585dfc159085b06496c1aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649971, "uuid": "5d30be53-a10c-4369-8720-743e0c6d1da5", "value": "T1EEC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649971, "uuid": "cffa10eb-2350-4fb5-9959-5508b6cf0d42", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmP8O:LzhWutxBaORaebXQd+mzBzlk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781649971, "uuid": "20802c44-61c8-4ca2-af0e-2d4731de5bfd", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781649971, "uuid": "fc727cf3-d742-421e-957f-ae2d18f6c565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649971, "uuid": "85c832cf-e917-43c0-b054-2548e68b8cd0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7f9f8a-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625603, "uuid": "97391680-0f64-4a22-af81-d5bcb75c2721", "comment": "Malware payload (Mirai)", "value": "6350fecf46c45055f6335beb73befa05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625603, "uuid": "c01c29a7-2b90-4f0a-9b18-6f52dd078eea", "comment": "Malware payload (Mirai)", "value": "0310eed14d111822310e3a77c855988a2f999a9e2f5c7789d6ff378417e5ef17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625603, "uuid": "255c0013-f0f5-4ebf-8767-cb4b986b3fec", "comment": "Malware payload (Mirai)", "value": "0e95b286afae77e2e81f33a1f5fa9011782d42c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625603, "uuid": "d7e9451c-45f2-4589-a3f0-f7f1fa9ec1fc", "comment": "Malware payload (Mirai)", "value": "d8b230d0836888287ce502f7bfad57b8af82634ebb2eb594b18863516667821c929589de0a044d258c9abf4a28bc0871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625603, "uuid": "c117f399-25d1-43fc-8fc9-d3d5a103f66b", "value": "T1A0B33B46EA818B13C4D5177ABADF42453323E75493DB330699186FB43F86BAF0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625603, "uuid": "a51323e2-f5dd-469d-96e2-f39a3981d90d", "value": "3072:iBDUZQTIXAJrswSRlZpVyrY0HrB3M/9+FJS:8DUZQTIXABswSRlPVeFHrxM/9+FJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625603, "uuid": "8f4bb64c-a2e3-4e63-b287-8f4d7bdba862", "value": 116058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625603, "uuid": "a97a4411-ec62-4060-a5c1-04941b1be15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625603, "uuid": "54bd3f1d-5691-421b-942e-dd186eae72a2", "value": "44a752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ba6f70-6954-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781594555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594555, "uuid": "ad8ea7ce-6d31-425a-87a5-88e9fb82c4cd", "comment": "Malware payload (Mirai)", "value": "91c974d3fb96c0112b3e0dceef58426b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594555, "uuid": "69bdcdf8-f496-44c8-b7c3-85d5d6324e24", "comment": "Malware payload (Mirai)", "value": "03610fabf86c64268282bb62b89deab202a2dd4fea83601c9a8709fdd48f6b6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594555, "uuid": "b7b78a74-164d-4526-9624-21592c9515cb", "comment": "Malware payload (Mirai)", "value": "90ff11f6b43bd9631c2b222530c0fb851c682f1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594555, "uuid": "71ceaff1-527a-43f8-8a22-219e3db0f24f", "comment": "Malware payload (Mirai)", "value": "45ef23ddd9035dc63b2eb4ab721f0f0b7c275fb0e02acf6b4f50f722360295c19836e66e25ca705d933f2df289b34f67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594555, "uuid": "64e77f4b-fe90-48fa-a168-2a6c931af4f2", "value": "T105866CB8BB0F3851F3CAE3389B5E82C5B13BB1A5C16590E33840114DD5A9D5ECAB3A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594555, "uuid": "6da5c8f8-8890-4165-9a7c-6bafc9d61fdc", "value": "98304:mrR1nRXzRDst+kHBAVPL2p3X7mEY1trWSk4A0akLfaHXb+rq:mrTRXFogyMPL2xiEYuSNAWLfoXQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781594555, "uuid": "c812976b-c957-4dbd-878f-8cf433546b58", "value": 8556968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781594555, "uuid": "4b828ec9-d176-46d9-be4d-0ea3660853f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594555, "uuid": "0b5ab026-2ec1-448c-ace9-7ceb37096e83", "value": "xmrig-aarch64-static", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a62846f-697c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781611743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611743, "uuid": "bff7ab68-8097-44c1-98fd-6c06c6e633b7", "comment": "Malware payload", "value": "89703d0cb55a0d72283c59e3340218b3", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611743, "uuid": "d45b72ce-9725-4569-aa7f-367491924f9c", "comment": "Malware payload", "value": "03c852f23af131d33910523b3472bc74ca625649674fab19b96fd539de6edb51", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611743, "uuid": "d3f04b41-2af6-4dc9-b7d0-a11aee4bb8bc", "comment": "Malware payload", "value": "db73d222d660a1f96e34c5ad74271f78f62b1a7b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611743, "uuid": "43f5b473-2681-4111-b758-3988958c6d24", "comment": "Malware payload", "value": "6b69dbecad73949af9c23f0a42ef03f45b0d3798ae922d82c403790ab183f5955d9c677e4c89dd0996b3ed25789f345e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611743, "uuid": "b7b9ae98-ef1c-4513-ba10-7351eeea5167", "value": "T169251256F850EE0FDA978B3A8D87C6DE5524FCB15E5646873280B30E3E328B16D0359E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611743, "uuid": "78933df6-1e7c-4562-8b6c-d59f8ba767db", "value": "24576:MLHiiI94vUunKLrR17zPS8z+QHcz50S5:ML/IQU+mR17e8z+qMr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611743, "uuid": "8e50bae4-3eb6-44a0-816e-86c47d69a7fc", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611743, "uuid": "199f5f65-1ec1-430d-9e4d-82049d2313f5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611743, "uuid": "0a69c94c-8422-463e-8509-bf3861f15d65", "value": "Purchase Order RFQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a6496b-6981-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781613961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613961, "uuid": "7f645b3e-e48d-4459-8f8f-eccc79d814f9", "comment": "Malware payload", "value": "162b1abaafa45a957a4441ead3253a4b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tiramisu", "colour": "#6D2230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613961, "uuid": "afbaa2b7-cd16-4dd6-b312-f8f501dc4274", "comment": "Malware payload", "value": "0400c00cbcc6834ade203f8d515f5932972a3861256a9a7ca0a46638eec2a83e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tiramisu", "colour": "#6D2230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613961, "uuid": "eee33cb2-4dd6-477b-8ce3-ab95b90c5de0", "comment": "Malware payload", "value": "088f8731bfb2b6fa31a2d50e3ba53df99c3bad3a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tiramisu", "colour": "#6D2230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613961, "uuid": "386f0f37-e3b4-40ba-9118-2df6b2d7ad28", "comment": "Malware payload", "value": "421bb79612c09ff4748df499a036915d536e279b406ec24c417dcb97ae1adf1cd32d5ca4023395790e4226a93bcad054", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tiramisu", "colour": "#6D2230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613961, "uuid": "cc211693-dcd5-48c2-a83b-380e0522f760", "value": "T1AC66019BF748A96BC4F757BA0976436111474C268B43E7C3AD58323C18BB6D43F4AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613961, "uuid": "83712c56-a7e0-4837-b5c7-4c83f4fd685e", "value": "196608:ZEVnl6BSXkyXr+q9S0E+xRikcBb84+cb2OV:+VnlySX3Xaq9Sp+xRilfbvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781613961, "uuid": "66f5e1b2-5600-4a22-ba82-06d390f9bbd7", "value": 6975830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781613961, "uuid": "1ffb0d67-c706-4745-8b36-f7d360fb8dca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613961, "uuid": "e39e7a08-343e-4a29-baeb-9270d42f7c51", "value": "04.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb868596-696b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781604685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "94236600-c63d-47e4-969e-7f3bf20ba701", "comment": "Malware payload (Mirai)", "value": "c1891bec6766c3f83170223ce6526f2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "ad6a03be-2993-4275-a5f3-20d5e464124c", "comment": "Malware payload (Mirai)", "value": "0411287655a03474484e579014a664e34f6039bedd896a97a2d06d8676185bb3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "8556e4b5-fef2-4285-b832-7bd1dce75e69", "comment": "Malware payload (Mirai)", "value": "386917a162dabce75549cabbd03701db8868a583", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "92717200-00c1-4259-84e1-1a52b320d305", "comment": "Malware payload (Mirai)", "value": "725733344aa88602be707faf95448ef4aa66f5a7d5ed507c4178e0cc1adffb6fd91acdfb78f54e094571d4eaa0a9cb67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "5d0aa624-1e52-49b2-9288-d7fcae9da3e5", "value": "T1A1F30946B8819F15D5D216BEFF0E128E33231B7CE3EE72029D245B347B8A86B0E76515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "a52d41f2-d077-41a5-b8ad-b60a625dc0ab", "value": "3072:CM9a9e3fFEPWU/779Jf8saMQQ56XtykZgXHAsxSHsf:C19zWcVJfJadQ5PkqQKSMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604685, "uuid": "4b8f3988-049a-413c-a742-470e800b221a", "value": 160252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604685, "uuid": "750358d7-4245-4a0f-832c-b90e4c2af1bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "f07b23ce-213b-43ff-9a91-fbb4b700ee0d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c09dd3c-69bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781638938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781638938, "uuid": "912c914d-b8a2-4254-88b9-d6d5c25af6ee", "comment": "Malware payload", "value": "efdebcddcd5aedae4a69f5ab6bdd8c06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kelkel-rmtdelek-digital", "colour": "#E117F4", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781638938, "uuid": "d824f4e5-8973-4995-8964-ae00ec3d240c", "comment": "Malware payload", "value": "04b6b07de6f904d6379b500c8a9b216ac238beff99f20179d18a9e777741e6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kelkel-rmtdelek-digital", "colour": "#E117F4", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781638938, "uuid": "b633cb87-c393-4c32-869c-ba121936af46", "comment": "Malware payload", "value": "d7a93d633bd4e2fa2f7d16639ea17ccd2cd23a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kelkel-rmtdelek-digital", "colour": "#E117F4", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781638938, "uuid": "1772dfcc-6d81-4267-b3a3-4b4b7b0ca5fa", "comment": "Malware payload", "value": "edca049430a5f7ae287b24dd44cf5c636f36bbdac6ddb7e57617081cd5672bef9cc284cbc18f5c3e93bd2ebe06aac8cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kelkel-rmtdelek-digital", "colour": "#E117F4", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781638938, "uuid": "6873236e-6642-4423-a107-c90b6a9afc4c", "value": "T1F1A68D17EC6554E9C1AD9231CAB792137B31BC484B3223D72B50B2396E77BD0ADB9348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781638938, "uuid": "6cb3e06d-47bc-454f-bbde-0eb982e63d23", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781638938, "uuid": "d98c9548-586c-406b-b52e-25c75679b562", "value": "98304:7cNyTmuNUcf3jmEBv3MbZTmojEqG4Y+zzS9SbiRTbbPl:7DTd3XB0XEqGF+KSMTbrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781638938, "uuid": "aef30922-fe2f-4d1e-aa56-5db39eef5ad4", "value": 9510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781638938, "uuid": "a23abbc1-7795-422c-9009-09c79b0305e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781638938, "uuid": "bde50a2e-f529-4d5f-b3db-dd3ae72bbcf1", "value": "edgewebdiew.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13aebd2b-6981-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781613852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613852, "uuid": "8d69f8f0-af71-4535-8e62-e4563ab6f2ee", "comment": "Malware payload", "value": "a117934f6606d41e31b30b908534be69", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613852, "uuid": "4d7ca1eb-94df-4a10-b81a-8d8b5c957e1c", "comment": "Malware payload", "value": "050d91cde706f7c981f90878dbd50d92038caeedd38852a10e018e57f188e79b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613852, "uuid": "8b064732-8933-4ecf-bd24-d9593d663ea4", "comment": "Malware payload", "value": "d771c66d3ef174c2e2fbea3d9586e85b7d6e53d6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613852, "uuid": "c14ca50a-6cbe-46a8-9485-ad674a3e9ae1", "comment": "Malware payload", "value": "d2c7ad12f0f3f9823f5a1b31ff2a86380a94475ca5aaa6a46fc015ca31b248392a2b33361b6c8d37c4e115fa6cdc03fb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613852, "uuid": "6066644e-00d6-43f2-bacf-e0f213274e67", "value": "T16ED62333EF85B16FC9F2823349AA8C258D517E404783D90795A5717C087BBECDB1AAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613852, "uuid": "09d40a9a-aa4e-4eab-acf7-c212980d85cb", "value": "393216:U64rrYPnErB0BEtt66TV/M/TAqJCww+i2slkoRX:Z4rdrCBWtvlM/TvC2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781613852, "uuid": "3fcf5f11-c33e-4a92-9440-7554c9c1afbf", "value": 13616364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781613852, "uuid": "59019d2b-3237-4d46-891e-9a303bb39fe9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613852, "uuid": "a2595038-5538-40e6-a9f8-8ecc360b701c", "value": "05.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb05b77-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608658, "uuid": "5f193a6b-3d76-4d6d-b3ed-8f84c84fd2d0", "comment": "Malware payload (Mirai)", "value": "ab2f5109004543b5f3538f14c5faa122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608658, "uuid": "77175044-909d-4e53-a484-f4c58a19120d", "comment": "Malware payload (Mirai)", "value": "05cc49ab22c48366340115aac5c25b99d8c71934fcb6372dfc966f0a42ec955e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608658, "uuid": "a758a1fd-a24d-4a29-9726-e87ce49a3680", "comment": "Malware payload (Mirai)", "value": "96902514fc2d71fc62ded872cfdd2360645b5705", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608658, "uuid": "434f4425-24d7-442d-abba-9f770c712586", "comment": "Malware payload (Mirai)", "value": "7d008790ea40fc08923d0f8538941ac8e277677c1aa83f8bfc8fe46b65bf104ac92c29cfeab0043ff7462914db74d191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608658, "uuid": "b2102350-1111-469d-abd1-6d7c97ac8def", "value": "T16394D723C8154995D0615CF222673389BD0787BF8AE732D3DE2A5AB0BF6051F52BADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608658, "uuid": "1f2f9ebd-7f7f-4471-b084-8b3a0cf29e1b", "value": "12288:NsayGhG6QM8zwj4gT/6tpBjmvtkG7X0Nu:iqTCZmvtkG7X0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608658, "uuid": "ac1c81a7-a2e5-4f6d-854a-9aeaeacecbcb", "value": 408290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608658, "uuid": "5e4d3b54-8beb-42c0-b369-a281a6eaaac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608658, "uuid": "b23b8827-44bb-4789-b53f-77b1a313f079", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709a0f3d-69ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781632476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781632476, "uuid": "bd14402a-309b-4c75-940f-bf03077f64a2", "comment": "Malware payload", "value": "dcfbb2da70fbb5f5246307d7de4dc19f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781632476, "uuid": "806de902-b098-4e9a-9586-49962061cf8b", "comment": "Malware payload", "value": "05d7bea9f5e175d4b497d0585763a32a66b8bd832070fd7d9556edde90146de4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781632476, "uuid": "b9d44a57-11a5-4f54-9163-a1df6d98a69d", "comment": "Malware payload", "value": "cfaf810115d08216648a73ab30c52a36a60e8bb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781632476, "uuid": "da63eff3-e0d2-44e1-bd01-de3950e8c9ce", "comment": "Malware payload", "value": "db94427b98a7ac9eae129db9727d33fd672d75e12e0e3e46a05c6f9f9db6db19ee0636c6f47f3a679cb698b153c94a31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781632476, "uuid": "e4e5c6a6-a7f2-42da-8bff-592b87292b93", "value": "T14027CE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781632476, "uuid": "2a1767d3-4b33-44e6-8038-c0bef01dad6f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQo:cqYUQuVDt0TZEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781632476, "uuid": "d9a691f6-d0b9-490d-85eb-fdadf920d715", "value": 21823488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781632476, "uuid": "087923c4-bc16-44ca-92bc-eb4e45ad6cc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781632476, "uuid": "762ad29b-ec19-4294-8f71-d5589fa5265d", "value": "05d7bea9f5e175d4b497d0585763a32a66b8bd832070fd7d9556edde90146de4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33160eb3-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781608751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608751, "uuid": "85977dfe-331e-4916-87a5-ae0775efb65d", "comment": "Malware payload (SilentNet)", "value": "909a418fd253b4a3c5184415f2deecc1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608751, "uuid": "9bea74b0-cd2a-41d9-a072-618b99721ff5", "comment": "Malware payload (SilentNet)", "value": "060a2742ad55665f6b1a66b80cb636f343b7b8bf679ab85da83da2c0eba7fd46", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608751, "uuid": "05d6e3e5-9c63-4bcf-b228-47d1bf60fa7b", "comment": "Malware payload (SilentNet)", "value": "3b66e82c16e9352996d613b67d38d3a009ea2f72", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608751, "uuid": "c5091cc2-a61a-421d-b5f4-1fe1fee0f42e", "comment": "Malware payload (SilentNet)", "value": "5ef784a407df4d0654bb8533a952176b66db95f2acf709812f4e6b5d47e9a307a21529984ebaef414c4c4d7047dc3fc5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608751, "uuid": "eb8c65ab-a905-4aaf-8372-892938913d8f", "value": "T1D7C42350A20B8010E1C2CBBE9769777DEE33C5F04750442E9AB9F1DB68852597EBCD2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608751, "uuid": "81d4b8e7-7393-4f57-8019-6a71a7ca239e", "value": "12288:jUVIQ050IzzADtpDV+31rRrLeKNoEQuqTn4sQ:jVQ0zzzADkfrLeKWpudsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608751, "uuid": "7a7eb047-fe64-4cf1-b3f4-498f9e42af6d", "value": 572788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608751, "uuid": "d018469a-0dfd-4dd2-a0ba-547fb02faf09", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608751, "uuid": "ee477353-42ee-4519-afcc-0672e0cd30e7", "value": "Prestige Client 1.21-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcfadb9-6976-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609222, "uuid": "873e9cbe-6742-4a3f-a2f8-4f748a181393", "comment": "Malware payload (Kimsuky)", "value": "198ac34ed66b814e8704bd83d0afd2fe", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609222, "uuid": "40732d91-a99e-4611-8072-d1a0c4f61575", "comment": "Malware payload (Kimsuky)", "value": "0613dcc83d184ff0d8ef279d629b588e25f7eba60e12673ec260767216c82d3d", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609222, "uuid": "2f1cad24-462a-4d42-9723-f43681ebb856", "comment": "Malware payload (Kimsuky)", "value": "df13a74fcf3079163140ecb1a39a8d9a80315d83", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609222, "uuid": "4388d374-a26c-4687-8af5-04cdc6807161", "comment": "Malware payload (Kimsuky)", "value": "d49802ddb457fc83a11e4b04a36ecaa1653bd5b7e546a43df2a6e4f46897a6adbdf3ba187cffd0d5449f9abe26687282", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609222, "uuid": "05ff760e-11ed-4124-b1f9-63589b885552", "value": "T17CA1A4877516C3C623C2D243B7EFF58D7A08866D00BADCA0F4AF461D2355D5562B8AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609222, "uuid": "2254e7f6-8ac3-4aeb-a4e4-5780c8859f96", "value": "96:SUGimW4TADqgA19ebquyXRuIz4zrWDvgp+In+AuH0zQlL:FGxW4eyXRjz4zWO+In+AuH0zQlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609222, "uuid": "719c6ce1-2fa2-4840-ab7d-ec254e8c9d2c", "value": 5046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609222, "uuid": "d334b422-8a53-45d1-828f-4ad062fa9712", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609222, "uuid": "838933a2-2b37-4b72-aa86-2335ce3bdbd6", "value": "0613dcc83d184ff0d8ef279d629b588e25f7eba60e12673ec260767216c82d3d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7463448-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606852, "uuid": "ed3334c9-ebd8-4ff3-b3f5-201757225f7b", "comment": "Malware payload (Kimsuky)", "value": "a3a9e71729ca040aba3a28521bf0ead1", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606852, "uuid": "87e1ad7a-998f-4c6b-975b-58bbda7bb05f", "comment": "Malware payload (Kimsuky)", "value": "071cae0d46c2d4ca75870d6f4efb8e3122ed8d3dc9bf33366019f7d6652ff94c", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606852, "uuid": "5e1fd3ef-af9f-4436-afb4-a7297e24deb3", "comment": "Malware payload (Kimsuky)", "value": "19ad0688d549ebe3e2b4a5255759c1543334d682", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606852, "uuid": "0fffb340-42b4-4c4a-87f4-0b46463827c9", "comment": "Malware payload (Kimsuky)", "value": "0c2c808f3ac0d56ebad67be4909341810d249c6b01868835576896b8f2eb60c65f4a6c520635b51aa31dac5a6305233d", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606852, "uuid": "fd5d95df-2411-48e2-91bb-994d5139c7f1", "value": "T183435B3F583881ABD9E8E56800DD4367B858DFC630566FB805CA9B94861D2E73AC173F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606852, "uuid": "352e37a2-ef05-4971-a0bc-8bec25aac858", "value": "768:CcUR+MuVO3+UX6o1iSSMDE0QzsLtuZW7QtYqw4rn1q1JJ5jWg4K5o0OiGL1Oe/+a:KR+LC+Kr1SMDyKIoQCqw4rn1YJLzbSMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606852, "uuid": "78875777-53ef-4b95-9ed8-26c16e9f13e5", "value": 56579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606852, "uuid": "ee4b1442-fd3e-4de8-a5a5-86b112c591d4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606852, "uuid": "3d98a6ef-da9a-4a61-80c3-1f69b56fac58", "value": "071cae0d46c2d4ca75870d6f4efb8e3122ed8d3dc9bf33366019f7d6652ff94c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c8b26b-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623061, "uuid": "8c90cebd-5ae6-4b7b-843b-cb3226b847cb", "comment": "Malware payload (Mirai)", "value": "f8f8e178c87d26ba669ae3e061d7c15e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623061, "uuid": "b61eb0fd-ad58-4903-b474-1966aaa6cf1e", "comment": "Malware payload (Mirai)", "value": "075dd6847dae4c6ae77917913d825ac97302a27d576c399c686a53e6f32f0bf6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623061, "uuid": "57588b94-a661-43d4-965e-d9fb5cf7f45a", "comment": "Malware payload (Mirai)", "value": "2d21756cb04f4aa80d09aa6b8f010689e59165e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623061, "uuid": "02576441-c265-485d-b6f1-86678420daf4", "comment": "Malware payload (Mirai)", "value": "70a5b1f690b175123aca998bded9a1c3d38563bcfa4f58f595e9c717e8fe986ae2187f42f254cbff7e37724be34682a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623061, "uuid": "c3c1f5ef-82fd-4310-ad32-b0b5b8953b95", "value": "T19C933880F547C1F1D44709B15067FB3F9B32E1A96135EA1BDFAA9F32DA63542C206A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623061, "uuid": "2ea58362-6c63-47e9-8a90-b6f25f71cff2", "value": "1536:6cGItUCzI0ZDo+rDpukUC3h3dMWroyRN4BT4m5L9gGqvSVI7a4:6cNtR80ZDVZukUgZLRuBTxTq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623061, "uuid": "5b345231-47a2-4977-930e-ed3743755838", "value": 97608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623061, "uuid": "ca0b3ef4-70fe-4900-b34c-008124b3a4e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623061, "uuid": "2069c2e1-e7e4-476d-85e6-f6d5208bdcba", "value": "main_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df50fd1-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781650511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650511, "uuid": "981bcf67-21a5-4c93-84fa-b3c75b635a48", "comment": "Malware payload (NanoCore)", "value": "f661cb6bdab7657311eb5b23292f2f5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650511, "uuid": "becd9b27-c674-4a70-be42-1076b9cdb946", "comment": "Malware payload (NanoCore)", "value": "08342741445b3dc78de149eeb7bccaf5e5ea76d0223115c3113e6c73bc333eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650511, "uuid": "0cb89f61-7d5a-4665-8091-14f73b6659d9", "comment": "Malware payload (NanoCore)", "value": "02b299f5a7e907303e41954075ebcf52862b26f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650511, "uuid": "602b4b77-d73b-482d-b410-f96be619a8eb", "comment": "Malware payload (NanoCore)", "value": "195467d024f2793fe07768504f6ee23338cff778f4541e1a590a7d069be36b44f5a212d33877b3b9d5b729f3a2e213d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650511, "uuid": "1b8e22c1-c22c-4f27-a4d3-3197ceaab964", "value": "T1E614CF1677F98A2FE2DE8679602211528778C2D3E8D3F3DE28D455B78B267E00A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650511, "uuid": "aa2a95e1-9167-4a1e-bfd0-bce554ffb877", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650511, "uuid": "7cb145b8-54ff-496e-922c-66cfa09374a6", "value": "6144:gLV6Bta6dtJmakIM5Rp07I0o3SEoJ7X5wI:gLV6Btpmk2p0do/oJ7Xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650511, "uuid": "0502f07e-4f0a-4b7e-84f3-baf5e0464f2b", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650511, "uuid": "a6481b3a-76dc-42ab-b04a-fc982b31748c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650511, "uuid": "07cad87f-3c1b-4195-a8dd-8b55577f10be", "value": "notariaunicatoribio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acde8322-696a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781604231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604231, "uuid": "0cc217c6-8d96-4058-8492-e43f35f31f57", "comment": "Malware payload (AgentTesla)", "value": "e62204c85a58af02f728610f58a91979", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604231, "uuid": "d003ff1c-1a69-49fa-8f32-0421cace97a8", "comment": "Malware payload (AgentTesla)", "value": "08e895274092d92bb55dd029a3721eb7da924b131e52fb3a944ef67abc5238af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604231, "uuid": "5cf6d3cf-1ad6-4aef-b05f-a8c4dae94848", "comment": "Malware payload (AgentTesla)", "value": "35f1f40738c8cb6dbb4b3ddc0751210164bb09cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604231, "uuid": "e2d27e4b-e224-48c5-9b60-3627a7cc1735", "comment": "Malware payload (AgentTesla)", "value": "e7a3b01af3de28de373e12e778031b7f99707c5587d814a04eb9e3f7b47bc06d60973802ea8002ad2ee6faeb7992712d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604231, "uuid": "1d865bba-c936-44f7-8e0c-4d3aa873613f", "value": "T134253970DA2002774F83AB9CBCB90661C66DD329852705B1F6C98B0D910E9ECF77D66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604231, "uuid": "3488cf44-4dfe-4961-95f1-7ef1e686f084", "value": "24576:PvkVbqH866H4lxqunZeNxRkxeYPsn4r2INPLPzokX3HHZFYh4k1heJiLPpk23gjr:PvkVbqHr6YlxqunZeNxRkxeYPsn4r2IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604231, "uuid": "d0410272-79db-40e7-9e33-f29a30763b69", "value": 1003864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604231, "uuid": "ab1a6557-a0a0-48f2-8c5e-c74e1d34d745", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604231, "uuid": "7275fa68-05af-4588-92a8-bcc6816fe2d1", "value": "BIK1910486_20260616.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1377a8a1-6964-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781601396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781601396, "uuid": "d7f91dde-e8ea-4fee-8cd9-5ee63ae72003", "comment": "Malware payload", "value": "3171ef5d2ea58b7b83361d8d6133bbdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781601396, "uuid": "22c1211d-76fa-47af-8295-b1cb4e8790b5", "comment": "Malware payload", "value": "091dad3f141fddcaec631819deafbdfc42d5bdb6ceba919822b838ae7e073005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781601396, "uuid": "d117e576-098f-441c-8b55-31476c3a0a87", "comment": "Malware payload", "value": "2421b7a09732a15a3d68d0e0c342a3601561d562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781601396, "uuid": "fd8085e8-28c7-4239-9bce-3742c12781af", "comment": "Malware payload", "value": "a30e8fd9bab502e96be4e0f344b99669f3f8adbb7c0da7eccb49df257c08f3e342473fd957ef6288e07bbeb3efe025ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781601396, "uuid": "abbd270f-21d5-4c38-872b-45f999c22844", "value": "T1BED54A03BCE108FAC099B33189B266467B75BC081B3227D72E90B7782E76BE15D76754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781601396, "uuid": "03c0c058-85c3-4da8-b671-a6b57effaacd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781601396, "uuid": "ee36760b-921a-43a1-bc51-a6b70d4cc31f", "value": "49152:5mPR7/YhotUg+jyoiQKGKF5g2PoltJYJnvXcRk:5qayHG1OorJFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781601396, "uuid": "6198cea5-8345-48f0-864f-98750c8eabbd", "value": 2862496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781601396, "uuid": "e00bfa75-c578-4b05-b74a-4acad81e5182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781601396, "uuid": "fdd57b45-5b43-4057-9f61-b7e18b235d41", "value": "3171ef5d2ea58b7b83361d8d6133bbdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46fe7f9-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609048, "uuid": "74de52d7-ce78-4b08-a03b-433877f707b2", "comment": "Malware payload (Kimsuky)", "value": "0b97846442e85768673c3666b6c82d9b", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609048, "uuid": "ae501a97-ca2b-4313-b1a2-ea30cde3fdfc", "comment": "Malware payload (Kimsuky)", "value": "098f6bf964c66d88bf52d4366a87cf73039627b95d7622da149ee6704c03c7f0", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609048, "uuid": "a397ea99-5ced-4afa-a64e-86a2b48e0001", "comment": "Malware payload (Kimsuky)", "value": "d838b5c4922d979deffdb9aaf676d67616394d27", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609048, "uuid": "b33552d5-62a4-41c0-9dae-529d824783c9", "comment": "Malware payload (Kimsuky)", "value": "877112b5ebd3575723cbe0d2c7b311a5017726b84fe8e78da76290a48d07212cec873d4bd2cdd9d62171191b45c7b48c", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609048, "uuid": "5527871c-db2e-448c-8a19-8f767ce8ea5a", "value": "T1B4C2F987621AC7973781519F6A97E4CA3F44C83D01AAC290FACF4D6DE39980891FC769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609048, "uuid": "f7271fb1-01c3-4da1-913b-b9f686a9d761", "value": "768:/fjiafZpbAEDtgOtoyPvqoiCLX7tFi71mAsovuIy5NrB4/YqRHa+K:DX9IjvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609048, "uuid": "c226f295-1b28-401f-ba9d-876f24aced90", "value": 26334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609048, "uuid": "3730311f-ff5a-4f7c-a995-9acff503bbd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609048, "uuid": "19a2e5f6-9a77-4398-81c2-c0c18ae19d5a", "value": "098f6bf964c66d88bf52d4366a87cf73039627b95d7622da149ee6704c03c7f0.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f5f611-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608655, "uuid": "0811f103-0b6c-4de5-a5bd-28bc06291f27", "comment": "Malware payload (Mirai)", "value": "9e3628f6ca599aeb50ea8c8ecbf39bcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608655, "uuid": "3690ad0d-d4c4-4f06-aa2d-9a3f7a345956", "comment": "Malware payload (Mirai)", "value": "0a1dfc6434b51020cd5f80b30cae5a46d350c78b4ebd02fe2741e3c6b6018942", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608655, "uuid": "cfa7de57-d6f4-4b85-bf67-9460aaa1d830", "comment": "Malware payload (Mirai)", "value": "4d87a7103f52e7f33bc499f69f44c67f1e513f68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608655, "uuid": "9ab8ccc2-a70f-40e8-b18c-5709481924f9", "comment": "Malware payload (Mirai)", "value": "bb00fb8993e2f1afbe9b2dd921d181566a511cbea2b68ef683bb04bfcb809b5c8bd9e5d7595df281ae8de9ee004f578a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608655, "uuid": "655b541e-dc44-4577-906e-51abc379ff1a", "value": "T1C974983399194595E0154CF2227733919D4B87BF88E722D3EE1A5DA0FF3142B52BAEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608655, "uuid": "8b389628-ca5c-4bb9-9b29-0e62f189c1db", "value": "6144:L6f5RrSx0a4TKwjo527t9mX/ItseRiaKANb:2C4TKwjHzmX/ItseRiaKANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608655, "uuid": "e235a98f-f8dc-4d0c-bb19-1f2b21869aeb", "value": 343403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608655, "uuid": "8701abe1-9a74-487d-99cc-9476d418d8db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608655, "uuid": "6bf4a41f-bd59-4028-b17f-c33429df04c0", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4359cd5-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607733, "uuid": "0edc9964-dd24-4f49-971f-69c7b4c3db7a", "comment": "Malware payload (SilentNet)", "value": "8b7bcf8ba30a4c638451c39768fdd364", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607733, "uuid": "b4db735d-9295-4d76-8009-719ad1f13de4", "comment": "Malware payload (SilentNet)", "value": "0a42b99f78e269ce343f5f35c96df1a42c640c2f96b6dca1f3bbc88426cb50b4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607733, "uuid": "116a751e-2f62-4a17-82de-df3ac7029f68", "comment": "Malware payload (SilentNet)", "value": "52298e70002dbedc8c09918fde8a2bbd1c4d6f3e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607733, "uuid": "7ccdeb8a-1431-4db0-9b25-f1b831b9b862", "comment": "Malware payload (SilentNet)", "value": "aa969eaeeb9c564ca4d39cbecb89bfeecbae31672a56c56ed7e3e0113241099af496e81f86ea8e90df87875703c7cfde", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607733, "uuid": "4e7979c8-9f75-4c0a-bd20-3d32306f706b", "value": "T150F533353BFDD87AF65A93B5FA12845068D7C2CCCC0A901B05598ADF082AD6C7B11B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607733, "uuid": "20fb5efa-b261-4ad7-b7db-8ed59444e30e", "value": "49152:xg7ul4lRrCV/JokTlxR0/b6hxESL66Zewd8CWQzcQ2OvSxV7eF1X9JbUthZzT:mil4/QVxEgtZejCWBQ2MSPW1ttI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607733, "uuid": "bdf3fdfc-886a-47f1-952e-c6ee2b54e1c4", "value": 3622341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607733, "uuid": "319861cc-ab0c-4d72-be7e-9dac3e7add20", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607733, "uuid": "e8b78ea9-a4e3-4722-895e-a1992e3f147b", "value": "KrispyyClient-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad876070-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781608956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608956, "uuid": "f24af043-f45e-4340-bf52-232ad4f7b6d6", "comment": "Malware payload (Kimsuky)", "value": "7ebac61fe341cd83da8f723f857db045", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608956, "uuid": "bd18ea8b-2ce4-49ce-ac38-6e28793abac1", "comment": "Malware payload (Kimsuky)", "value": "0b051d56f9022dd5d3aca819bf4a58009fbf39c7de33e0938f9959be0e862ef8", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608956, "uuid": "ad908a55-4501-4d46-a95c-94d15f3ab84a", "comment": "Malware payload (Kimsuky)", "value": "11566fd0deeef1a481bcffc1cee52df700014fc5", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608956, "uuid": "e896e9c2-c329-4462-80f2-d267fa3510b4", "comment": "Malware payload (Kimsuky)", "value": "e83ce718c7ebfb2b9ccaeb12f06b38acd961c3da66b04db8be18ffb24cb8ab9246bc15aeb8b369383faaf969c3f6ec30", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608956, "uuid": "3942cb2c-08ab-4702-9ddf-3ca6b1203b18", "value": "T18FB208473162D38AB98122EB768BE8C83F0CC53D00D957A0F89E8B6D9355A9C91FC675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608956, "uuid": "40c00529-fc39-4767-a72b-a5d6967cb174", "value": "768:u5Q4uhj6fvukeZYSjBm9p7rfiT3jamHOA49n0xilQfwb38Zhx6aZYZlslW:n9K7riT3jGAON9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608956, "uuid": "0b8cd7ea-3b83-449e-b48b-b5abdfb35d48", "value": 25486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608956, "uuid": "886ce425-3d46-4898-916e-94e768d46ac3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608956, "uuid": "1990f358-43a1-4a59-8789-267f75c18a80", "value": "0b051d56f9022dd5d3aca819bf4a58009fbf39c7de33e0938f9959be0e862ef8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b13af8e-697f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781613220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613220, "uuid": "3cded14c-b088-4615-a573-f82894f7a2e1", "comment": "Malware payload", "value": "98e69ddd066fff99485a6a3328c98a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613220, "uuid": "7184295f-2d29-467e-b25a-d62e16c15ba9", "comment": "Malware payload", "value": "0b4d99dba5adb4e3f0e43771484fb048d0946a0da2b83a621dcb565164248191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613220, "uuid": "cbea929c-2a45-4d37-a309-420446ec89f9", "comment": "Malware payload", "value": "ae4d8d37386cd8b7b5f0396ba21c5d493e3d054a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613220, "uuid": "be153f1d-76eb-433a-a69f-6035ba3a414e", "comment": "Malware payload", "value": "42b5af29a2e426c4e1a0ea2f902cb7e591eaf88ed2ac383dd201351d92a0a0b55529532cca603cfe1ea593fc10e850ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613220, "uuid": "d459b3da-dde9-4676-b624-be08d6920a4f", "value": "T18B863379ABE011FBFAEAD23D9952C472C326791B2B25C4D787E080E45E637C05A37712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613220, "uuid": "c90bcddd-384a-44bd-8a62-f040b3c32dec", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613220, "uuid": "27ff348c-8d22-4f10-b5b6-be393d3dcad9", "value": "98304:0y3UGQ0nuaZf5CA2CvSuZhCMYkcIt5FkOwSrIcUsLXRLMEODwb3p8FPg6XwKsmF:J3Fuof5CA2CaurH/P/XRLMEO5P2KsmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781613220, "uuid": "823f793c-4a8d-4d05-ad46-1fdccc8db088", "value": 8030258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781613220, "uuid": "a79e7655-2c4b-405f-98b0-0ee281971ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613220, "uuid": "14c4f18f-2204-4367-b002-0bf81844b5d0", "value": "Incident_Report_POWER-CSIRT_2026-2847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa15105-697a-11f1-a769-42010a9c0008", "comment": "Malware payload (VantaRAT)", "timestamp": 1781611081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611081, "uuid": "acb63670-663d-4c3d-b156-874a3bf7a519", "comment": "Malware payload (VantaRAT)", "value": "7a2cca7b79606f125755ae7a28a53ae2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611081, "uuid": "9fd3f308-b9cb-4579-835f-e2abd7ef3564", "comment": "Malware payload (VantaRAT)", "value": "0c0de2b5e95f5cddb78d767a2acf295088b1c11a9843d89b37d33bb646fbebf4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611081, "uuid": "4a2ab5b7-5035-4c7a-88c8-5ad9b090c20f", "comment": "Malware payload (VantaRAT)", "value": "467753ab0e90a99399b4dc9dab3543b1e17cb37d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611081, "uuid": "315ca666-c059-4525-99df-61f1b59e3e1b", "comment": "Malware payload (VantaRAT)", "value": "6833928e117d2398b84cd741d268aa32a8f6a17051358896dc14075ca412171540facb40aa16a9f393c2d446673d9cb4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611081, "uuid": "8b8f29a7-836a-485a-898f-91ae1f199c44", "value": "T19253F47218C9311C04F699A90B606493572DC9ECEF9BD7FF76264AC1C92EB87FD20864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611081, "uuid": "f17b1b4f-33a7-4aa1-8720-cba72e36caef", "value": "768:nkCPd1Yg4FIqHE4nG/6zXi5nrXKYCdBHu1rlArK/K+33DhyaHQw:kCgnBG/QIrXKYYudCrgTFya7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611081, "uuid": "01433a81-950b-4275-a78b-63dfdb058d2b", "value": 62342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611081, "uuid": "fab4e492-af7e-49df-a3ea-aebb80639c8a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611081, "uuid": "de55494b-da86-44a6-a684-c70c844ec61b", "value": "WindowsUpdate1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e99dd2-6997-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623550, "uuid": "fabbd8f7-faa3-4cf2-be30-e38ff9de1c48", "comment": "Malware payload (Mirai)", "value": "a25a5e3bd07038181325320953310963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623550, "uuid": "3d52eba2-8df5-4e87-b878-93e3cd3ed855", "comment": "Malware payload (Mirai)", "value": "0cb61a9f30ac5cf022b425243ef2556f862e1a629110164ce182689c991272c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623550, "uuid": "0983d3ca-fa52-4114-bbc1-4805be814f1b", "comment": "Malware payload (Mirai)", "value": "efc6a6ea75dcb2b94cf1830b30bc3bcdb24b7d21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623550, "uuid": "deb07a0a-1778-4de8-9277-f563cf560608", "comment": "Malware payload (Mirai)", "value": "a1355c94dd86f6b722bce65751f89ac05937f793a467f263485ce59e74082275cb4f77ea1ef456e50acfcf19f39f219c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623550, "uuid": "1413ddc0-143d-48bc-b037-2519f4914d07", "value": "T19E142945FC919E13C6D522BBFA5E428C372A17A8D2EA3103DD255F21378B86F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623550, "uuid": "0e6da945-6e49-4f77-822d-8fc8420cfb8a", "value": "3072:FF8MmnivqELpwChizwETwbLUg+v66Ya6mODP4QJ3X2Gr1jBwh7r:FF8MGniSCUTwbQgCFfuP4QVXPBjBw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623550, "uuid": "28cb561a-9956-48b2-abdd-8b497b82a704", "value": 208800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623550, "uuid": "ddb21af5-3dbe-4178-afd5-8f7f44deffb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623550, "uuid": "ecc39179-a2e8-4a47-aec9-df65022bf80b", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9b69b7-6988-11f1-a769-42010a9c0008", "comment": "Malware payload (WeeStealer)", "timestamp": 1781617085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617085, "uuid": "aed89871-673e-434e-a959-0604314f1e99", "comment": "Malware payload (WeeStealer)", "value": "b77625cae72301aa6736c543f1c9d80f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WeeStealer", "colour": "#3BA661", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617085, "uuid": "10b83c46-a4ba-4812-8a78-648ca4a1ba49", "comment": "Malware payload (WeeStealer)", "value": "0da7be1647f31711fd16932c46c9897f5d5d321746d4e8ff0f5184c59d08cbe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WeeStealer", "colour": "#3BA661", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617085, "uuid": "120c7325-4ea3-455d-9aaa-edb3552619b9", "comment": "Malware payload (WeeStealer)", "value": "4b71682ee75869007a32d565642e39eb1f233dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WeeStealer", "colour": "#3BA661", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617085, "uuid": "e288d481-5280-4af7-824a-a9c0cf53c50c", "comment": "Malware payload (WeeStealer)", "value": "4bf68384e3cda0a68acd60bf595588fde45bdf93f8ae13e666ec3a61e67df67b7ae3cec5176125190c5d8e05f158dd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WeeStealer", "colour": "#3BA661", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617085, "uuid": "010debaa-093f-4847-9c62-2834ca780dd3", "value": "T151546B09B7E800A6E6FFC67884B31645EB72B8521331E7DF079546A90F737D08939B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617085, "uuid": "14b9e3a7-fcdb-4b27-8d0b-5681554b0e0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617085, "uuid": "1a5ab2f7-d625-4a45-aad6-9e9644ca56fe", "value": "6144:2GG4um61hlQv4VJirnjcJAGISiPJ0U2kgV:2nXbWvJn4JTmJ0Udg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781617085, "uuid": "79ed5ce7-e8eb-498b-a08b-e70f97f2e05a", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781617085, "uuid": "52793127-a8dc-481f-ab8c-76806dce556f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617085, "uuid": "f522332d-16e1-4b1f-b3d0-8fb3a93aca4c", "value": "0da7be1647f31711fd16932c46c9897f5d5d321746d4e8ff0f5184c59d08cbe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41b3bfe-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608538, "uuid": "c7126fd4-619e-4826-99e6-d040cee13adb", "comment": "Malware payload (Mirai)", "value": "9665e6650ea0a87ad993415009177624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608538, "uuid": "096a56dd-5996-4c57-a625-e0c8f9155309", "comment": "Malware payload (Mirai)", "value": "0dcef23b188604074f2d052d273db2bee3e4d167f4c49fc239e66456466ca26f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608538, "uuid": "698af62e-3d4c-46a6-aeb4-b43c8747df59", "comment": "Malware payload (Mirai)", "value": "89ad2ba01925ae8fb305dd2f12f4ea347f9e79c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608538, "uuid": "23d0b06b-1c7e-46a8-8307-ef0bae35d641", "comment": "Malware payload (Mirai)", "value": "ccb72ebdf517debf6743c7cb53525f0b9417c08c757dd832d17140e2aea21d9e2f13ec78ecb8f7b88a039367bdf39e73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608538, "uuid": "8c377332-a833-4ed5-b64c-5c84273e1893", "value": "T1DF84763799159A69E1248CB213B73B519D4746FB88E222D3EA2E8954BF3041F51BFFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608538, "uuid": "88673985-9d98-41b7-b18f-763706ae1ec9", "value": "6144:MZk4PLzKaDtwwjoG7uT/mrjhTJfjUHcMNb:Mrpwwjt7uT/mrjhTJfjUHcMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608538, "uuid": "c02f1bbd-e28f-45aa-b8ff-42cb410dd753", "value": 390453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608538, "uuid": "3b168532-9f6b-4c7c-b1e5-af249bc66d4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608538, "uuid": "07d54a81-8b49-4e1a-b82e-0ea7d1a146f7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd475116-696b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781604688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604688, "uuid": "fb6513ee-ba9a-4267-8c63-4bbd7068e07d", "comment": "Malware payload", "value": "f2ec0332b7c2a8ad94d13325aea98f11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604688, "uuid": "f1dcbc34-a6a7-483e-a208-b07c8a560202", "comment": "Malware payload", "value": "0e408bfac2c575af774fb2af8c94eb32eb2748fe987f45c4b1e491453cc1415a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604688, "uuid": "a3dbe508-cbbd-43f6-aeb5-6cfb923f0bfd", "comment": "Malware payload", "value": "fe59f6ef563c14d0e3ca73a14903439ff99f0a99", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604688, "uuid": "359bb7b7-9f7f-4491-a812-33b2647f62f4", "comment": "Malware payload", "value": "2ff01bbd50d5c03ace4195d6eb7a40514131041203d5fb27a6f8b1017a6b9e1c993f3f836419eb9c2c82548a1eea14bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604688, "uuid": "a1e3a0cd-f697-4008-803b-7cb516c9070c", "value": "T12CF0ACA721B0DC3175B4C92DFD9782E0104B182728292509705F7E40BB2C98CF286655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604688, "uuid": "4a62e1bd-152b-4ad8-8ef5-1ea48e4adf6f", "value": "12:Zx80LXalnLeHt4ayzKuPfFFHshByuFNkjXfahx:gAalyHt4aIpnF1/ihx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604688, "uuid": "b65db82b-2194-45b6-9c73-793a71d498a4", "value": 621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604688, "uuid": "e83beabf-a97d-4da5-96e8-4f33556b697f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604688, "uuid": "73dbd3f9-992e-4067-a95a-ce0972bbd1d4", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28caf704-697c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781611740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611740, "uuid": "cf6c47e5-163e-41e0-91fb-6cd8d4fcbfef", "comment": "Malware payload (RemcosRAT)", "value": "63172a50cccc3ccfc0ca7a67a47c809c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611740, "uuid": "1dec95e2-f863-4d5f-97b2-31d90aee656e", "comment": "Malware payload (RemcosRAT)", "value": "0e63afb1b86f8b302c7f2dc58989e9f37024a5107b922a79864a0c9f9e04ac88", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611740, "uuid": "ed9671f6-4372-4ea3-8787-a7343a6dc64c", "comment": "Malware payload (RemcosRAT)", "value": "c3566ee97d50c26b4b3a7ca6c04055d38db43d6a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611740, "uuid": "77037f2a-b3a6-436d-a338-2152a97a5118", "comment": "Malware payload (RemcosRAT)", "value": "1ba0c6aea020d2bfe26c9d7a973e8d928ef20c655a179f4a7f7ce5e1b31feb57437d57c795a59014c2614bbf9399cd8c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611740, "uuid": "80d5278e-89d7-4dd1-a386-b744653da8e6", "value": "T129450CA2DEB7DE3ECB798F314AE68205A7745C52C331CB07A5853139BAD9E20BD450C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611740, "uuid": "4c567526-2f2a-4678-84ac-695115d61ba2", "value": "12288:zDylH4wSo6A8EVZau7yLLw6OrB7aDylH4wSo6A8EVZau7yLLw6OrB7:q+waEcIdB7x+waEcIdB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611740, "uuid": "65b327d3-1ab0-497b-8bce-b3875d581ca7", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611740, "uuid": "0af5521d-f191-4377-81c3-8a4da44171e6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611740, "uuid": "7bbc0d5a-d0e6-4d41-98d3-4e151f991f19", "value": "2774851063 - DHL DOSTAVLJA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e02816c-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781650430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650430, "uuid": "845edd9e-c1e9-44f4-bc50-6f9bc0879f0f", "comment": "Malware payload (Mirai)", "value": "99cd300516f54fb3c0044662375848b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650430, "uuid": "26f2eed5-9e80-4689-b4cb-34330f0a3e2c", "comment": "Malware payload (Mirai)", "value": "0ed289f7321abb2e191710c504a6f34a59fd4761fa15f574e3d3f805563da11e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650430, "uuid": "dcdfea78-b826-420f-828d-e90511241504", "comment": "Malware payload (Mirai)", "value": "315e4044b3ab1130df5ca8b0a98c82ae3644440a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650430, "uuid": "08caab96-b1c8-4a4a-b0bd-ca3e3d4e4479", "comment": "Malware payload (Mirai)", "value": "ab7cd7fe2a899a445f2ee2897e1aeab67baa542faecfbbbc0c9718a5ac69f803ed4ffbaa71037b5f3fcc4a14d6cd3ce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650430, "uuid": "73df61cd-6d20-45e5-bfb1-f102827ef87a", "value": "T10B934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650430, "uuid": "4531d859-8e6b-4d59-8470-a5a9bedfdb59", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINJS:XGptyz+VJzB7T9/bLUAx9e/SBJOJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650430, "uuid": "a975ee6d-3347-447f-8e37-34892b1d84e5", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650430, "uuid": "12d5579e-6a55-426b-81a5-5a84c2739032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650430, "uuid": "9e7bd754-f04e-4607-a041-644553085e6d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be10bcf-6975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781608900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608900, "uuid": "d054598d-2745-4e7d-a72a-a81aab0f5d2d", "comment": "Malware payload", "value": "46f751751e52bc5d6f1a4ba490af32de", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608900, "uuid": "51bc6c57-6243-4e95-845b-88500d14e29e", "comment": "Malware payload", "value": "0f21d86b582a34c4ebd8d1a424aa948bbb4b6307a88d1bb2ade0d6bd228bf8e3", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608900, "uuid": "9da10ddf-e113-4fdd-a0cf-ab01992d4c0d", "comment": "Malware payload", "value": "6e5b53a0f0e938dae863eb09d301d443c1ab7e2a", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608900, "uuid": "5df47de9-d23b-423e-8007-59b0f0942c43", "comment": "Malware payload", "value": "7159951dd790f3c104647240b57981df25fe92d7441b6262f42fb4dd96a079bbae0ad2ba11c60988e77e1964fe11131b", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608900, "uuid": "b53f7fcd-d4e1-4ac1-9731-5ae7de9d3ef3", "value": "T1E031326B614A2399838A0107EFC763047198707D01B6E685B9EE1739531873FF571B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608900, "uuid": "784e051d-420a-45ac-b0b0-b035e1dd40d6", "value": "24:MjNA67Vxg8FN1AwLufAB/ozVRNGJ4JO9VS+GszsnN4p9R3aoKoSHgh8r6H2/Y:VQr9yKuRA4cGgsY3JSADHCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608900, "uuid": "4fe61a41-143e-4ae0-8b50-9d8d51e336b4", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608900, "uuid": "fd378b6b-62c3-45e8-8a2f-af1147eaf2a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608900, "uuid": "a8f239ab-46e4-4a0f-bf85-bf376dde8d7b", "value": "0f21d86b582a34c4ebd8d1a424aa948bbb4b6307a88d1bb2ade0d6bd228bf8e3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c62ab1-69c7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781644058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644058, "uuid": "816fefab-3d8e-4b2d-a0f4-05661cb7ed94", "comment": "Malware payload (CoinMiner)", "value": "b17ae941d850e0d6baf662aa84b1df6e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644058, "uuid": "9302479f-13ef-4c12-afb7-c9dbc0e4032c", "comment": "Malware payload (CoinMiner)", "value": "0f5b306d0e04b56939893e35f82e218b618fbe4ec3ea21ff7316e866a46e9eb2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644058, "uuid": "b620bdac-eb65-4a2e-aa62-10c1cc4dc444", "comment": "Malware payload (CoinMiner)", "value": "9489d727ae6c5e174ff63f8c1104022ea5bbc296", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644058, "uuid": "ef054c50-d251-425e-8ecf-eef8fd76972a", "comment": "Malware payload (CoinMiner)", "value": "d5614436d4ed28dd4bc78bd6f80bddaa0917424e1db49659291636e8ec2305aac811b9b3290976be60e9faf3878f1cfb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644058, "uuid": "c357a827-b70d-4137-a84d-d174b234f0af", "value": "T14B322B29BE4A0331E3A048F81479424F653D5633E3D7E3EBF333955A4A962448800EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644058, "uuid": "c157d8aa-d623-47a5-87c3-e18be0f435d2", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644058, "uuid": "34d44e06-d5e5-4add-9098-c1ca1761adca", "value": "192:P3ouW2yDBa9x+en53JpPFJxTEZmFhSac:P3o0yg9wA3JpPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781644058, "uuid": "75626f14-fc13-4dfb-8de0-e365fbac9f2e", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781644058, "uuid": "2e0312cc-f886-4c1f-b95c-d1e2f00bc064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644058, "uuid": "f9acb985-21d2-4760-b374-844bf4d6e2d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79453fe9-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "a6a06b1f-e229-4dca-b754-abb2df8155ed", "comment": "Malware payload (Mirai)", "value": "909b5b836cdded512b86e015f54e7800", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "9852c0f3-636b-40e5-8ef7-2bb48838b0e6", "comment": "Malware payload (Mirai)", "value": "0f635d750e93613593fed85df1d8d6104af83f25729cb13f32593fc7760770b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "4805337e-7764-44af-9e67-0a499809c940", "comment": "Malware payload (Mirai)", "value": "37df8d8099516e9538119ef6c209bf1c69f00016", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "2aa0c559-b943-4528-9f2e-bf2c5613b062", "comment": "Malware payload (Mirai)", "value": "b8693841b7f977d865210a408c13fb8e0e1c15c9838a43cee562d209f033583ed6c26b91042bb5ebb347dd0ec802f81d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "962eb847-c2e7-4180-a68c-e3ac699b0d37", "value": "T1FE310F91B6D04DBCC8F411FEAE8B0311B3679F00E0C67122C31CA358AD2AE3C6D2645A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "cb278dc5-2089-4ff3-be19-fef8fab08191", "value": "24:uTchKGpa7Urz/jlfcAXK1YH9Vev3gRGRP9ilBBuLlZ8n69gW29:ughKGpa7UrLZKdlPmBuDJ29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623042, "uuid": "f7f4114e-1b37-4d57-9b1a-b3481371bb68", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623042, "uuid": "bb61fa45-5dd1-4b4d-af56-eac2f46a380f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "c428a898-9aaa-495c-8d30-5d1e3f6b3d05", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c34f2d-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781608967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608967, "uuid": "704ec88b-ca37-4f94-8457-dadf77f0dbad", "comment": "Malware payload (Kimsuky)", "value": "495e74869b1f251f89cfafb7abb77a2f", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608967, "uuid": "c1a3f74e-110d-45c9-b34d-12e953bb137e", "comment": "Malware payload (Kimsuky)", "value": "109e8a17675023637528b1cc55c808d128ab86394be6bad89c0a7f823980e620", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608967, "uuid": "0ca35684-2e85-49ab-b3ef-d13e851d2773", "comment": "Malware payload (Kimsuky)", "value": "5a3e327a96ad6a3f5cb085917d29ecfb8450facd", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608967, "uuid": "0ea97ad3-9630-4bb2-be9b-a2e28c5b6dfb", "comment": "Malware payload (Kimsuky)", "value": "3173fdce8919eeee84ad2976efc1864547537a17220d9dd9cf87cd68ffc83c7c7d2ea803c29464e7774a5aead6a05d0a", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608967, "uuid": "d2a45c48-3e6a-4a30-b744-0daf6a98b5b3", "value": "T18D9194E3B907C3C2F2C1924BBBEFF5983A18C66840A989A0F8DF564C6315D9D81B464D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608967, "uuid": "b7c0107e-8bc6-4879-b764-864e69140fb0", "value": "96:MZIAvHcccgXvSAszMTZBWA1zI2VoLT0CPN1C+4/BgOpyEHn:gfccrjZ2IaEBgOp7Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608967, "uuid": "ef986989-6ad3-4118-80b8-fe7da5d82c79", "value": 4602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608967, "uuid": "e1f26cfd-5bee-43f2-bee9-d7631e187f61", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608967, "uuid": "64cf71d0-22e3-4ddc-946b-463b0f6bc7d2", "value": "109e8a17675023637528b1cc55c808d128ab86394be6bad89c0a7f823980e620.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20475346-6995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781622463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622463, "uuid": "cf4a3715-fdb5-4028-9591-07b4d8f46bca", "comment": "Malware payload", "value": "98063cbe1a5d3dab655b246427fbc9de", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622463, "uuid": "ba3e7c8a-5124-4e72-be1e-0b85f2a2184d", "comment": "Malware payload", "value": "1109236df36f02f1dc1c8266a61d46f6176952180f0a0fe38b6231b92aff1e48", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622463, "uuid": "cfac26c1-4c75-4ca4-868a-7341cc1f515e", "comment": "Malware payload", "value": "8b9f9a9aea16c0d4e3ef0e4317c9963382ab5922", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622463, "uuid": "91d400c6-91e8-4dfe-ba2d-a73b34ff0932", "comment": "Malware payload", "value": "c8f71f0a015b6b7298b58db8295ec6ca9b7d28dd4fa0a853c676a8d3d4486ad62113442e09abeee3e51ae007806cf1c4", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622463, "uuid": "8458f401-0d56-408c-b969-8dce1136c87e", "value": "T16F74185B73968E21D2841232C1D7150583F55887B63BE70E7985239A2E033FBEE4B7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622463, "uuid": "985c9762-611e-475a-97ca-2c0dfc839e5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622463, "uuid": "f46129b9-5ee7-4de4-929b-e0e72c0e7abe", "value": "6144:XP93BTx8tSmY1o4K4drxWTzjc/974o4gybYe8IwJMx3uPD:Vtx80p+m1W3G74z9tw6uP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781622463, "uuid": "7550c357-c223-47e5-abaa-164322c79b3a", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781622463, "uuid": "f4fda73f-fa1f-4d90-a83c-8b8b77ef808d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622463, "uuid": "731dbfb4-4eea-4d80-8ce2-0861091df5a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49242f8e-69cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781646154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646154, "uuid": "b629b266-9ff1-4535-adb9-53ce987544c0", "comment": "Malware payload (Mirai)", "value": "ee33f7bb93d44305ad50e73ca8b04c2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646154, "uuid": "e7298fc9-7889-4c18-89e3-98fb39f620be", "comment": "Malware payload (Mirai)", "value": "1153960865c4456a6ae71cade2b29ea8cfa586c280b2ada2e994d7e72e432b9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646154, "uuid": "afe57f82-6f2c-4ad5-bc98-b281fd704ca2", "comment": "Malware payload (Mirai)", "value": "141eb01d835e9ba4b5a91c87b82458ce1f6ba170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646154, "uuid": "bb4ad31d-3b0a-406e-91fa-0e2d8706e779", "comment": "Malware payload (Mirai)", "value": "71917225c3362e2b90d0d6018b8abfd7282fe48cb71826425e04f71e62871f8a2524b4b10c8144b4712828486da5d1ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646154, "uuid": "a8c5543b-9b1c-4faf-8c60-f31283bb33a0", "value": "T1467302C68681D264E8311C3ABFECC45FB22277D4F1D1936B46B835000E8A9A747FDAD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646154, "uuid": "37067acc-b5bc-423b-aa22-586ac8fd5b2b", "value": "1536:bOSyh7Cdcx5f+TFNoS8Hp04/JFSPfCq+rTTunnR99bD+6qwi84JOuaPEsvlYhNEM:bOPh7Cdcx5yF3kpJ/uPfJOTyR7nVPEsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781646154, "uuid": "021daef8-73bc-4845-a779-c06623d66e37", "value": 79192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781646154, "uuid": "98daa6d8-20ff-464a-9952-0d0d7ef8a8c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646154, "uuid": "8c9edbac-9229-479e-914e-5abeb027fb1d", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4911482a-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781650449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650449, "uuid": "1abb604e-5666-4964-aebe-db9f3c1947e0", "comment": "Malware payload (Mirai)", "value": "b65ba829173ebfab4e6215d291243eb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650449, "uuid": "6b410fcd-8e56-4028-8742-7b94ca8a1324", "comment": "Malware payload (Mirai)", "value": "14373998bd1bee54088685287949148069669ca30d0cc7e266321ecf686341d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650449, "uuid": "d5c261a3-e6dd-413a-8cde-ac022e3f3677", "comment": "Malware payload (Mirai)", "value": "057906f0f8b64586223788b20248ed65ac241296", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650449, "uuid": "88bb1f90-ae55-4237-a545-855467d5da9d", "comment": "Malware payload (Mirai)", "value": "0047d6a00753e3f10364fac1b2196a52d3b7cf9037ee2fee287a2357e6ffc7e644bad6617a42f8d6105640243c151bee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650449, "uuid": "0ed40f0f-eb79-4356-a54c-07a54c06f9c9", "value": "T11D933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650449, "uuid": "c15ce9e1-07fc-4854-89a9-b2bd319b5e55", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vdi/2rXEv8i2X2xPSUUN4J+Lh3R:KvjLrKGG4syfEurXzi/xpUN48Lh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650449, "uuid": "088c5889-c770-492e-8f8c-a8a1bb8da251", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650449, "uuid": "3a96c85b-6bd3-433b-bc5e-55893d24e61e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650449, "uuid": "cb0ce015-29d4-4fe2-a732-8002a65fc12a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499b13ff-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625539, "uuid": "9dfb1443-d587-40f8-97d5-e1ef07a063c5", "comment": "Malware payload (Mirai)", "value": "59e2ce41b8b4e2832e560da87cc99827", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625539, "uuid": "ccb0bc83-e592-4390-8f45-ec00a442662f", "comment": "Malware payload (Mirai)", "value": "1637e7ba1a81d9d1e6dd228d601c62f2a28daf03f2534cb09038da6185d3e789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625539, "uuid": "47d36f8f-20c3-407f-80b7-d43001c70ee8", "comment": "Malware payload (Mirai)", "value": "bdab9024d71497d9c5d3127e32fa7c74d6d7c8c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625539, "uuid": "155af785-a482-4b86-90e4-75b09ca47ec4", "comment": "Malware payload (Mirai)", "value": "13f37e29f51db3f29bf133ac95f8634bc0d71814dbe355681d9ffa8fb0b4cfc9f735ce5138138dff9fece814b2f6c25d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625539, "uuid": "ce04b72e-7d4b-485e-9597-49ed1e030935", "value": "T129F2D782BC929956C2E4237AFA6E518D3322A3E8D1DF3217CD251F017BCA51F4D67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625539, "uuid": "45bcc5d7-0882-4142-adf7-2230526c792a", "value": "768:0I7sFxdndVd/TP9+47FRA9s498IoSWjltdLOnDPw2ot/PN:1adnpPE4DSW8Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625539, "uuid": "b565c94b-582d-4f7a-ad0a-8d55f5d9d329", "value": 37364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625539, "uuid": "28b80e7c-ed5d-4a79-a951-5369a01e935a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625539, "uuid": "f7fc1d4a-c192-4e5f-8bd0-c4fcf71d9617", "value": "b30ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eab5b1e-6978-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781610166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610166, "uuid": "d97160d7-0658-4e49-900c-6f2805568a10", "comment": "Malware payload", "value": "0d3f52416cebbc0debae6575ced27217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610166, "uuid": "9563d57f-9aa3-45d5-b5f5-861d02030443", "comment": "Malware payload", "value": "16ea0e764d2687af77988f99fbc3799e75c91b233828319e340fd67f14ed8d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610166, "uuid": "0fe638e8-186b-49bf-a744-e2efacfbe41e", "comment": "Malware payload", "value": "d4aa8490a5f2b352ed6bf4cf52f7ed0701db3e97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610166, "uuid": "4504d73f-3c9a-441f-b780-ac8ab5782a0d", "comment": "Malware payload", "value": "65530876f437da64aefc8c4403178162561b9d88004635367919414c96f6cc9e990bada8a81414091e94c416e3b06bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610166, "uuid": "c993c446-a1cd-4924-99f5-662acb3780fb", "value": "T106576B05B3B04AB4D11AB6F4CA6797F2DE71BC51073D968B1E55CA0E2E33B907B3A211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610166, "uuid": "e3474b27-44da-487a-addc-e1c7ce55f9a3", "value": "6a71197838babad857b54a6ecae33094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610166, "uuid": "5691d7a4-3f39-4db6-903d-90cc4c99fed3", "value": "49152:wmhcVFG4Xg9kd8RKJ4cAPQTUcxB6qpr1+B:MVF0PQTUkB6qpr1+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781610166, "uuid": "6b1a964e-ffc7-4c06-ab72-86dd45b79d6e", "value": 29149184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781610166, "uuid": "393b838f-df5f-4c31-a6ce-d0a734100ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610166, "uuid": "4dc276cb-b8f8-4d24-9984-7fc69d3eb588", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70c88ec-69bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781640782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781640782, "uuid": "bb94c500-0011-46e7-a786-de75578e479d", "comment": "Malware payload (Mirai)", "value": "a4464302ef2e69505f98a5f3dccdee44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781640782, "uuid": "d37f0ba7-160c-443f-8cce-1eb834da0615", "comment": "Malware payload (Mirai)", "value": "17a8f797f518fb326a02d0298103f0f55e2de2f3ba89e53d15b9e99630c9991c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781640782, "uuid": "63a52b98-a2d0-4511-97ff-556a4c5fdb69", "comment": "Malware payload (Mirai)", "value": "91500c48dda44c5999549c55307db97ae8487dee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781640782, "uuid": "2b88989d-949c-497c-8fe0-ee07c2420e7e", "comment": "Malware payload (Mirai)", "value": "e2b228287709e5dcf6589b600f93bd4041cf9d44942efdbdfd58a2346eebda8b37f110c98518a370ac6c9e25660875eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781640782, "uuid": "9240e2b5-f90e-4941-86d7-08c026600b93", "value": "T1B1F3A95D6E228FADF67CC73047B74A25976823D623E1D684D2ACC1142F6039E641FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781640782, "uuid": "e614e233-23fc-41fa-b9f6-c4ab0e25af76", "value": "3072:JaAwQlXeTEu/S8z8VKclHe9cX2lmxVjNJJtZNy:JVwQlXewFfllX3xVj7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781640782, "uuid": "1fc6a6ce-6e6e-488d-99e8-6c778605cd8b", "value": 158436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781640782, "uuid": "7596b68b-4bf1-47db-a9c8-662ec76f20fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781640782, "uuid": "fee3ed92-5b8b-4aaf-be22-979f3ad8f333", "value": "hmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be064c7d-696b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781604689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604689, "uuid": "3ff97c36-3923-496a-a1b0-636be97ac007", "comment": "Malware payload (Mirai)", "value": "e768d42a9e902f522dfc02a0a2de12ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604689, "uuid": "d3b0dec2-2425-4633-b273-25763ff90ef3", "comment": "Malware payload (Mirai)", "value": "1843e5e94adba98bde3cfa034746ec97696a0b0d20f0934b1c91a5bed3414b69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604689, "uuid": "8874b079-c648-4ed0-8975-d59ff61290a8", "comment": "Malware payload (Mirai)", "value": "21043e43b6f6c2b53c02ce5eb0ec8bd23198e03b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604689, "uuid": "9bed70dc-15df-479b-828b-9db5d3a49de4", "comment": "Malware payload (Mirai)", "value": "ca4729c644f5526f1effcebd60eef7de688781e870c03310e5ef9e1ee8d246e68364aac1a31bc9140172821e7501474e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604689, "uuid": "e50455b3-b1ef-4569-aeee-adfcf71cdd7e", "value": "T1D9A36DC4F683D4F6FC1216752027B3368733D839502ADA97D3B9EA77AC52251AA1B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604689, "uuid": "ffe1c527-12b2-4caa-b932-c0ba3ba61c5e", "value": "1536:BO2P6vzHTPFLMlwahRzZ7Ey1XP68HLfnS83Ef9:BNSvzzWlLnZTR6WSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604689, "uuid": "4712eae5-6e03-49a9-af85-7e75224830c5", "value": 100812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604689, "uuid": "7e1af4a9-cb4f-4d2e-a40c-9efd27c5beaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604689, "uuid": "c6d42e61-d69c-4cf6-b4d1-a3989f4ed996", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c848b0-69c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781642902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642902, "uuid": "4fdd74f2-8187-4fdc-91fd-746b53ab6b9e", "comment": "Malware payload (Mirai)", "value": "964b08c53771005ec6d99f4dcc7f9acb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642902, "uuid": "b09a3ebb-2742-4a16-958e-a8ba1f8de477", "comment": "Malware payload (Mirai)", "value": "18abaa0afe216522554bce230141b4ed86775c73acdce2eaa2a6e536ee982a76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642902, "uuid": "012630cf-8da3-4652-b13c-fb7781480c13", "comment": "Malware payload (Mirai)", "value": "557a0e13abb1415d5e098dda9dadf274fb780fc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642902, "uuid": "0bd72668-dbad-48a0-b753-b74ffcde4fa1", "comment": "Malware payload (Mirai)", "value": "32746c5ee7c2c30e9c6b8492cee992c6dfd1fa4d93e832d25ee7194ab67fdf90be707d9b65230cddc9fc8892654090da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642902, "uuid": "a0021bcf-a0dd-4374-9d44-e6c873891fd3", "value": "T1F2931289C67878B7CF680CF2A29E766F19C7734715DE27C4A414199D9AFE179F840032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642902, "uuid": "1e91f0c5-b230-4084-b51d-6e1837e9fa0c", "value": "1536:iR09aF3sFC5qNJwAo4whlvc2d2PT3+v/KlR0z2gQZntg+UTvo4idbpTZ:iR083iC52SZFlkvz+6X0zN2nC+ofidbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781642902, "uuid": "0ad3bfb4-d171-4b08-959a-39c131713cd0", "value": 89552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781642902, "uuid": "e2974b9f-c199-473c-a1ac-5a80ded3b9e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642902, "uuid": "d9e3c7e9-11e5-471d-a9f7-77197c40feab", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca87c436-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606858, "uuid": "69b1f9e0-55dc-455b-ad46-706d48212d63", "comment": "Malware payload (Kimsuky)", "value": "694d3a442fb04fc2cedbbf65f885cee1", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606858, "uuid": "4ab18e88-01fb-43a6-9691-0b3816e4a2bd", "comment": "Malware payload (Kimsuky)", "value": "18e387b068d3de5ffe5386aeea07f7baccd8207c583e04797f8c4dfbed6dbf59", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606858, "uuid": "03e7fe07-bfe0-4982-a867-ef7b36c0011b", "comment": "Malware payload (Kimsuky)", "value": "d2c52d41199800ec4d485ac8423a92835b691ae8", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606858, "uuid": "cf56cc31-47ed-4ec6-86cd-520f6b6b0514", "comment": "Malware payload (Kimsuky)", "value": "78bbb9ed9698e2852fe85090dd0ae8f6e74a4a155d31d13f9d2400f788538a719828683d71aa4ae39d9877ec1d74e5a7", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606858, "uuid": "14610a92-b9e3-46ef-86a2-1a5ea1b8c897", "value": "T157334D3E399EC163CE74DF9AC2C19342B54049D770B89B01B5F6EF084062986FED5B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606858, "uuid": "c0942501-0e4c-432b-ad75-0e116d7798a5", "value": "768:Cc+N3K/HTAcBgis0sNSzSzIp2+1019IhlDbz6Vhz7wJKFr8txr6:0dKUcGX0Duzrr1WRbUR7vOze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606858, "uuid": "b68f5ad5-a1e8-466e-bff0-340b5d6affd7", "value": 54689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606858, "uuid": "82074814-ec98-4549-ac13-57e6aa7eb379", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606858, "uuid": "51c15da1-c3b1-401f-8a46-ae89633cce53", "value": "18e387b068d3de5ffe5386aeea07f7baccd8207c583e04797f8c4dfbed6dbf59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4ad9a2-69c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781642294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642294, "uuid": "46fca58a-aba7-4198-a9ae-8968615d6f2e", "comment": "Malware payload (Mirai)", "value": "70b710506a1c0cf7ecfd583ea169fda5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642294, "uuid": "16f1357f-c4eb-402b-8914-2ec07df138da", "comment": "Malware payload (Mirai)", "value": "19a87e0a5ba28bfc483e991366db7144859da060196582bd86bc57e34aff60f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642294, "uuid": "42197a96-29fb-47fd-a01d-6cdf5f4ac64b", "comment": "Malware payload (Mirai)", "value": "2fbca034ef5a3d2844edf3989c11f98e787bd0b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642294, "uuid": "54abcf37-0e87-4920-bd9d-c003745569a4", "comment": "Malware payload (Mirai)", "value": "c637ea12bf058a85e733c5a8d3e680908de31f0aed42c052fdd3533c1b3eff5b147c4cdc44901d18c1987ff23c07c8c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642294, "uuid": "34bad102-3303-436f-8fec-00d33fe2082d", "value": "T19C31C58BC0141E391707DACDB3AB3248B10C46EF294FE7E0D9495EED86485C9B256FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642294, "uuid": "a8449074-a46b-4cf4-a0bc-e4821eec0ead", "value": "24:CURhRdavduJJLJjkzk3MCNUs2f3GHHi+laamsh2:YlCkzk3MCNUs2f3GHCALR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781642294, "uuid": "20969f51-b948-4eae-bc5c-ac0203c19b5d", "value": 1644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781642294, "uuid": "dc5eeb83-705b-455c-a4b9-9955a544a340", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642294, "uuid": "b065b3fe-84b0-4ac9-8460-5f5c4528e323", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25f8cef-698f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781620158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620158, "uuid": "43f90323-c691-4b15-8109-4594c0447064", "comment": "Malware payload (Mirai)", "value": "b13a7eb7864313cdd866dd88797b4791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620158, "uuid": "ec95358c-c448-4215-87f0-8a0f70afd379", "comment": "Malware payload (Mirai)", "value": "1b87483c2c74370018b8f1f15a7faff5f69dc6f73d39a86841f1b24619764662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620158, "uuid": "77edd8ca-e59e-4425-bf26-6d8d4aa50259", "comment": "Malware payload (Mirai)", "value": "cc9c3d97971818480b28a9345583e5a379c55d82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620158, "uuid": "b573e509-b089-4bb5-8155-e93b5071d739", "comment": "Malware payload (Mirai)", "value": "2bd7395d19f21a977b90d54ed05a1ab3bfd4329444c69d7a1a5ff4d9f9e98f1a62d7db0afaf5515bc87f09484a8fd7be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620158, "uuid": "fb2a24f0-eb49-40a7-aa0d-b9ddaacd9e84", "value": "T1C8D3C91A9F550EBBCCAFDD3702A9064139CCA55722A43B763274D638F54E90B4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620158, "uuid": "f7daf916-08c0-4d8a-ac63-e117145bf83f", "value": "1536:zU6FnOiD9YQbkgsWEpkRKKW2vDJCflcdwd+v056jAuHX2Sl9Gp6FDiXZJR:BFxD9FofW7KfYRg6j52Sz+JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620158, "uuid": "dda172ad-2565-4440-b281-15333e3782f5", "value": 140532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620158, "uuid": "4a69554e-8a8f-4411-8577-c5dc2c9c282b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620158, "uuid": "c448acba-3f30-424c-8eff-193ca459515c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86a1b2a-698f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781620168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620168, "uuid": "a9742ae3-7106-4f41-9a9a-6b850aa12dbd", "comment": "Malware payload", "value": "8c03d8eea8671904a6221db3901eaec6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620168, "uuid": "839a4d1c-d61f-4bc1-a1a1-df2fe3570853", "comment": "Malware payload", "value": "1b905eaaa3a6d5e29417a21ea0a2e1ac4a2ae25b89cf210a0e64286152a5a160", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620168, "uuid": "22c14394-728e-4d7c-bfff-570a2b79f7b5", "comment": "Malware payload", "value": "9ddf04fa1b8b9af0c67f0f9a71ba6263b2cdb418", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620168, "uuid": "6090cb80-63d0-48bd-a46b-daed97417f6a", "comment": "Malware payload", "value": "6faac05cb458383dcb55bf17ae29b06aa630fdc8ac9beeda9ca23756a53cd6fe7fe3ea2e64724e0a6d27ed15f4f75e77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620168, "uuid": "23f7e5e9-886c-4ed6-b86e-b69208a5ac57", "value": "T1E3A30985F8504B17C6C652B7FF4E438D7B2A175CD3EE320399156F603B9B9AA0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620168, "uuid": "3870d3ec-82dd-42e0-aa9b-b931648db65a", "value": "1536:Zc6sbmFcAWSz4Vx2LV7/96yLz+Osp6bbYnhlwYwyw1lHPWV6ledsEMWczwv6ZJQ:ZjsKFcA4axL96K1bUahVhzGSJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620168, "uuid": "f78f660f-0ffd-4dbe-99ad-8f037fb04157", "value": 105036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620168, "uuid": "a3eb087c-7409-4f41-8505-8505682704cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620168, "uuid": "422921d6-fb66-41cf-a160-9c0bdc7be81b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8da302d-6997-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623632, "uuid": "a1b8d3af-3698-470f-b70c-11a8802ef741", "comment": "Malware payload (Mirai)", "value": "0bf1cea6dd18dc97ae3061318e97ff6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623632, "uuid": "18630517-ff98-40f7-b8c8-fe15b016d829", "comment": "Malware payload (Mirai)", "value": "1b9f41c4b778f80739afffc1a03aec619ec5d2c83439946b7e70ab1aa89ce967", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623632, "uuid": "ab1903b1-f89a-470d-b3fd-82da1fabd1f7", "comment": "Malware payload (Mirai)", "value": "bd0e7492a2ab3d31454f0eea2d73beaf03b0bf0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623632, "uuid": "ab74e9ee-fc21-409d-a8b7-2aa7773b4aa4", "comment": "Malware payload (Mirai)", "value": "5c769fe0b9f539f12ba7e3c26914f0591d2409799b372484b873e7be8b9981dbef6de5bd6c8c2f3dc8143f9a119cea41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623632, "uuid": "87e9d745-2378-448f-8d8e-8247912a7b10", "value": "T1658302077321542EE6BC61746BA62BF91DB017DEF340E86235189FC78C2E25848A5FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623632, "uuid": "dfcd8f69-eabb-43c0-a389-4f3a2fe638be", "value": "1536:vhmHbgJPcHn0h0hKLItVtKW6Dmy6yhsCchHCMsUoGNYmKYYj40NPP90poAVJuw:o7gBcH060ItqCdyhsCc1CMsQYNy0dP27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623632, "uuid": "92560fa9-22f4-4bdf-b93c-3022667e4944", "value": 86724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623632, "uuid": "1fd0f350-e6a5-4b5b-9597-b281a028498a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623632, "uuid": "729d752d-25b1-4c6c-83e2-db15eacabe20", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f9ac95-695c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781597958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597958, "uuid": "025cded8-a644-4ab2-82af-eff30de82f1a", "comment": "Malware payload", "value": "f7ce1f3d43be1b826ee9625a93216549", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597958, "uuid": "977112aa-6811-4fdb-b5cd-bf1e41337634", "comment": "Malware payload", "value": "1ca67f72ea267442f0568a17511f286c6170d09524f0831addf667dacd7501f8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597958, "uuid": "af0945aa-7242-4347-b65d-47ab83b53784", "comment": "Malware payload", "value": "dad838b94d7f595e4040447c6b919e1bc328159c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597958, "uuid": "7855ac08-ecab-4a56-9643-93245106bf97", "comment": "Malware payload", "value": "84708514b8bc5f4bef6e6bd24674b22d521ba9a3a6afd4a15be0d044e23425ff5b15719a02ece74101b54f3aeb12ab83", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597958, "uuid": "8032943d-d557-41d7-b77b-633b06533713", "value": "T15B137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597958, "uuid": "de6e9a73-f3a5-48b2-8976-1219bb8d73e4", "value": "768:i+HV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:i+HGco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781597958, "uuid": "c69d112d-3100-4133-b944-b3774f25d3de", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781597958, "uuid": "7d160d10-0bad-4de0-9fe2-330a9caf1c55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597958, "uuid": "3f2864e4-ce7a-43dc-b4d4-164c64ce6996", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf62bbbc-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781608986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608986, "uuid": "1a7b5d53-9760-4258-a9cf-516f0f2d2f55", "comment": "Malware payload (Kimsuky)", "value": "aebde4c754c9cce70492777bd8bb07df", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608986, "uuid": "642f6c1d-2d85-48d7-bfdc-8c3a8736109f", "comment": "Malware payload (Kimsuky)", "value": "1db7b57e68218dd7125bffd84adbb6c06c10dc97d242bd554e3cdb1ee8f665f5", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608986, "uuid": "489cf149-ef58-411d-9d8c-192a351b579a", "comment": "Malware payload (Kimsuky)", "value": "084055dfb71599447f8beb847febb9900a50c492", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608986, "uuid": "b6e90f68-346c-49d9-8833-4ea868a8c35f", "comment": "Malware payload (Kimsuky)", "value": "ab095bcacd3ca207c5581d958faba8dc4b31875cda0d9097aa2136f2b4fbb3ec3a506b1bf5dfcf229a04712960de94e7", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608986, "uuid": "c5f4d651-ad91-49e5-b50e-8b557877a35a", "value": "T19E92D6E2B291D3C9748D9786A39FE8DE3B088176016755E1FCCF4F0D1326D44E2A8A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608986, "uuid": "f93d9474-2749-465d-85d7-aecdd1d8bbf6", "value": "384:k/GkDXt/Qk7xsNriwC8kd7LNboT6qaBbQ2QVySzApBiZ3fA3HVkmRsY/tckODIQm:k/ZDXt/Qk7xsNriwC8kdOmq8bQFySz6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608986, "uuid": "fe21559e-700b-4142-a8b6-9738d6230603", "value": 21152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608986, "uuid": "df214cd7-a56c-4048-9a0f-e18df0a1981c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608986, "uuid": "e8893803-608e-4be2-a773-c893e937c867", "value": "1db7b57e68218dd7125bffd84adbb6c06c10dc97d242bd554e3cdb1ee8f665f5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0093afa2-696e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605660, "uuid": "67ba1e2a-2c04-4cbc-b200-3867b5318142", "comment": "Malware payload", "value": "5b034d96bfdea520f7c184cb96dd51d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605660, "uuid": "f45a10ae-39f7-4c04-a28e-94b3aae634b4", "comment": "Malware payload", "value": "1eaefd0927c4accde10b6001cbb19491bd8344a945694cbeb82be954436b372b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605660, "uuid": "56b9b2d1-5d5a-469f-93b5-6c909cfe0926", "comment": "Malware payload", "value": "7c87a32bf203ba3b26d1c1730702209ed205c180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605660, "uuid": "6f5884b1-c956-4b94-8e11-41d7f6a7753c", "comment": "Malware payload", "value": "c75c9db38a02223fce20816081e056aee02a315cbfca4738aef63453dbd9bcd0fc1f47c85976ba118cd9fc58d0a2d729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605660, "uuid": "906b5390-8f1d-4de1-9b7b-e6450306f5ab", "value": "T134960107FCE119F6C0AAA27189669196BB31BC481F3123D72EA0B7782F72BD09D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605660, "uuid": "1a1e43e4-e88e-43d7-a6cc-7ff4d32d1c9f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605660, "uuid": "cfa5f396-cc1d-4373-a361-b330557fdd06", "value": "98304:JV8i9eGKDlE75Z8bNJiURwIGS2BToSELwY8POyIR7R8kPVTHbo+yT2n3e/eOgFW:JVeGUT373GS2o70Y8POyI3TdTH0VGO4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605660, "uuid": "31770c9c-aacc-406e-80de-8cbb38ce500a", "value": 8702936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605660, "uuid": "ff10a3f9-95e6-420b-9170-040ae731a4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605660, "uuid": "39fb4e21-3ada-4757-a26a-e3d7ba0b2107", "value": "1eaefd0927c4accde10b6001cbb19491bd8344a945694cbeb82be954436b372b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a78ba62-6995-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781622588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622588, "uuid": "c1138a4f-4627-4ecd-ad3f-5891e500c737", "comment": "Malware payload (Mirai)", "value": "c7608cc5a8ae911e844f54009c269b02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622588, "uuid": "590c8515-8670-4f5b-9de3-7681d9a3d1c3", "comment": "Malware payload (Mirai)", "value": "1f62c4c4f747662d08af5b10c5f5e6bd9a116cb4994382c88fcc55360b28430c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622588, "uuid": "b591ec17-fdcf-454e-9e5b-56c1c8337391", "comment": "Malware payload (Mirai)", "value": "22cecfa8d010e61a8ddcab3237cf86b2ceea4d88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622588, "uuid": "7179db0d-1758-4996-8047-bd7b5587569b", "comment": "Malware payload (Mirai)", "value": "57f96b65dbccdc1822c59564e42dcb4aa13b059e1fe68ea46028c4c8c589c02792f6a6fee1282d5f5100eac874cd7946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622588, "uuid": "2cbdb693-db94-4afd-929d-6d765a29fc6f", "value": "T193543B46EB404F13C5D6277ABA9F0245333397A4D3EBB206D9246FB43B8779E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622588, "uuid": "e693922b-5a08-407c-a87d-50d051b40820", "value": "6144:5g4+yc0eVBfeEm14Y3/sKasNZwMft/auQQjzd+JGjV/GrTPUmg2aA7s:pKv0b3/sKasNZwMftCujnJ/EImgzA7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781622588, "uuid": "241fe416-38b3-421a-9e10-4f5b30b5b86a", "value": 286381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781622588, "uuid": "3478e28c-ff29-48a6-ade7-e769a27c22a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622588, "uuid": "8b9ee34f-b809-45ae-8b8c-646cae748568", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca426e1c-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607716, "uuid": "2eba2df6-ac60-449f-82bf-87564773522f", "comment": "Malware payload (SilentNet)", "value": "3512a75b49dd76328011d0755b2b287d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607716, "uuid": "500ea23a-647d-40fd-ab99-69a86f8ada1a", "comment": "Malware payload (SilentNet)", "value": "1fa96d7fe18a71f99f86fc2dcd81fd21de14041d19769b9a85e22bfa53a201b7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607716, "uuid": "e3df4bbc-7b5f-4c73-8417-fa6781e50b54", "comment": "Malware payload (SilentNet)", "value": "9508c3d0f9f5dc1ad03962aad34ef474252676c2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607716, "uuid": "bb5a01ec-81bb-4cf3-b2c8-315279703bf5", "comment": "Malware payload (SilentNet)", "value": "7a1356df46f6a329757ef91411c0d31874cb4af4590e909ce0f53cdcb2dac8bb53f438a7e3062dbe74b8c7791c69cf45", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607716, "uuid": "8289445b-10eb-46ba-92c8-19bf7300375e", "value": "T15394E16B3AECC6ADDC479338F1409433793A2A505605E03B3D78650B4E6EE1E2F49BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607716, "uuid": "b285f294-2ae2-4ae0-ae8b-df3cb4e31415", "value": "12288:rSl5F5qtY6jMWB+cahbA5RBK0K0FLTbvP0BUg4BZG5AD:k7cA+qb0FTP0cHGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607716, "uuid": "eb0df2f9-674c-4457-b531-d1d210a05766", "value": 417028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607716, "uuid": "341a8170-d218-4bd7-acf6-1376de59a3ee", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607716, "uuid": "71ebe85c-d55d-4704-b2d2-4f0638f82de5", "value": "22QQ-Client-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e05cc04-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621681, "uuid": "6dae5555-ff07-418a-b214-4c397cbb0e18", "comment": "Malware payload (Mirai)", "value": "2ea580901ab97816b7aa103504e8bc51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621681, "uuid": "194bd62e-f9f4-4180-bc34-f00042b49963", "comment": "Malware payload (Mirai)", "value": "1fc9858abdd6e1746d9d2e9703dbcb109ee0dae62608bd4c602fa148a19e4b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621681, "uuid": "063bf8ad-c73b-4b98-95e1-5791ccfe8473", "comment": "Malware payload (Mirai)", "value": "297ada8f584bd5cbc85e8cfa5e114f665ee436da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621681, "uuid": "ce508acc-5bfc-4d19-9f02-814a5a57aee7", "comment": "Malware payload (Mirai)", "value": "6b7d8bd009c277060918172a3565adc74242b96393f636918548350dea12fdce4e62d3c04598e41474ca99a39106f438", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621681, "uuid": "5a52a4f7-be20-46f9-b4e7-ddbb295e5860", "value": "T10FB31842BC82561AC6E5737BB96E568C336653F8C3DB3516CD214B64378A92F0E73B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621681, "uuid": "9be23e93-6695-4575-926e-92c3cce0b4cc", "value": "3072:9v9HkMRjJdkZQoyBjYVIiURIaXxiKdG0LV6caTB:9v9Hku8XOjYAxiKdXVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621681, "uuid": "b0784d25-af8a-4e51-8ee7-00c619bbbc96", "value": 108840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621681, "uuid": "ed2f0120-a8c3-4272-9b02-b2c53feb384e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621681, "uuid": "fbb0ca29-74f1-497e-a450-780e70728ae0", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866d5a73-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781608891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608891, "uuid": "e5104ce0-4453-41e0-878b-f696f8bb277b", "comment": "Malware payload (Kimsuky)", "value": "75a1047442413a2be09facf14b7b163d", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608891, "uuid": "1b489bca-3092-4dd4-9230-ada9185abddf", "comment": "Malware payload (Kimsuky)", "value": "2033921b56cb06df97782d8b6cc34fc5ff0fa778bb7dc14054d0a554f4bb760b", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608891, "uuid": "26478b61-b14e-4916-876b-c7697220eae0", "comment": "Malware payload (Kimsuky)", "value": "0bb310755ed5815b1cbc2c2cca7476e4a0cbef2e", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608891, "uuid": "8405442e-361e-4e5b-a773-13e99dff0446", "comment": "Malware payload (Kimsuky)", "value": "6919a32286d2d6f5f04d0660cc87a60308bfd0f287914143bb2a7b81f889afeccafeb041ddf890f9dc4dbea3b2c95213", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608891, "uuid": "0d92bdce-258d-476f-a7da-504a33adb1e1", "value": "T1A1217493F41F5B8C53D5178FABDB9084B84C424E8184CE6170DC03A35360A1EA5EE24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608891, "uuid": "34bb142a-fe44-4090-8855-536a9b3fca39", "value": "24:2a5+6uhDeKOnffABujDUpj4NK0P1AWj5MQThgYJICLCY:2aoThqjXDU6NKIvSkhgYSCLCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608891, "uuid": "17bb4f6d-dcdb-4d0b-9883-8f423c788c30", "value": 1207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608891, "uuid": "a726d5d3-2558-41cf-b5e3-57660329639e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608891, "uuid": "5264c652-2151-4a21-84cc-a2054a90177d", "value": "2033921b56cb06df97782d8b6cc34fc5ff0fa778bb7dc14054d0a554f4bb760b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bf9230-6975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781608950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608950, "uuid": "c48aec3f-3698-49e6-aff5-1616ed44fc5e", "comment": "Malware payload", "value": "e678e4ab7b83aafa4eeada755162abac", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608950, "uuid": "67b1c727-fdba-41c8-a51b-4cad5d931955", "comment": "Malware payload", "value": "22dc7beae8cf1738d67e55b9007262ffe1eb5def4e46b9586c8d75b34cbba502", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608950, "uuid": "5a20e9de-bee9-4d13-9a5a-61240a856e5f", "comment": "Malware payload", "value": "51b8f6f92fb0293644111cea8844cfd5802105a4", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608950, "uuid": "8f54445a-c6fa-43e2-9dae-db2e8d6ab3b0", "comment": "Malware payload", "value": "9bb6b58e229d5039e0a99b664957f36a74cb022cfc377c5d553c4b6556824bc5a0bf4ed93c3d1a746743bcb2d47db795", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608950, "uuid": "688e623b-f399-4f09-934d-14b87b831427", "value": "T17F314551F14D95CA32CA9244E3DFD85DBB0585B9018601E1FCDF8ED913A6D08D3D9A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608950, "uuid": "b38a8b65-50ff-4160-a779-85aa6fb48cda", "value": "24:oiuS1PK+rQfABOFyvFNvFeJVvFz2by+fABrWOEikgfABQhkfABTybQBqY0/3O4+b:o7UP1UvRYujIgX+rblZ/3wCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608950, "uuid": "98bcdf49-0b6a-40fd-8784-4eece8ae5617", "value": 1561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608950, "uuid": "30eadafc-9329-477e-9e89-3c9003660d7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608950, "uuid": "e2222d4a-2b3a-4e62-b1cc-d93f321eb2d3", "value": "22dc7beae8cf1738d67e55b9007262ffe1eb5def4e46b9586c8d75b34cbba502.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b20fef3-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623045, "uuid": "2a36ab01-b4fa-4ca2-8424-01c151a0dd36", "comment": "Malware payload (Mirai)", "value": "ea51b66e77752b08006b63cab1522a34", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623045, "uuid": "887259aa-061e-4079-9280-7f51f27b50f6", "comment": "Malware payload (Mirai)", "value": "23a5e103dfd9fbe1ed5bb11bb4e15e56f5309a29963945055a3cc92592da90f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623045, "uuid": "7a73fc66-706d-4c8b-a555-014ba1e4f2a1", "comment": "Malware payload (Mirai)", "value": "c7082e614152765958e8aea8ef19e556177dc63f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623045, "uuid": "b02cb7ed-fc2a-4209-b6bc-dfdac5c6ccfd", "comment": "Malware payload (Mirai)", "value": "6e2b14c8c20934fb0ff585f19c3a9d443eb562208269bd4d2e07e4b4aff643ecdb54acb8a83fdfecc6d18222f420133d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623045, "uuid": "aef905d4-8620-4260-8a5c-062b361d700c", "value": "T1F421F100F61D1417E5E13EB477372B6147A98F03271444089AAFE69DE879C34498D49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623045, "uuid": "febecc6c-ced3-4a56-a715-d809c5b9d509", "value": "24:3WUpWS9nSWZ6S4/KSwISBd6oTKP5tAFlxa2zkt1Kkvy5eYaaTo0YkO6JJ:GVgZVbXGAVTz21Kkvy5tlWWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623045, "uuid": "fc761619-8693-439d-8eb0-2149800aeb67", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623045, "uuid": "8965c69d-a0a7-4d6d-b29f-45629e8b48f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623045, "uuid": "c48bbc83-24c4-4746-a844-ae55359943b0", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b779c4-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "5c0b36cf-c0ec-4e82-8752-c506c4daaa19", "comment": "Malware payload (Mirai)", "value": "e1c11fa6b26e8640942b8b0157d39721", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "3164b267-f921-49a4-9a60-a463c06947c8", "comment": "Malware payload (Mirai)", "value": "242e9d462b8f3899a7a23c21a9ea77751d14074069e70108aaf4ec7652e6c8dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "051a4dfa-886c-44e7-bc32-ad806a979597", "comment": "Malware payload (Mirai)", "value": "fe2df8bb150b2844a6d4c445415895ab9beb332c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "fcb35072-8aad-4b78-9f1f-2e355bcc13c6", "comment": "Malware payload (Mirai)", "value": "246632da2e3a926f485d777a27e726544f454767a62de7d6ccc943357acdbb21457179e78cdc7e9ddd4da9353f3c5cad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "693ac745-ea37-4908-8fc0-ee4cc547e645", "value": "T125E31B46F8814B12D5D111BAFE1E128E37231B78E2DF73029D246F647B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "d8e1ef5a-278d-4247-9185-f7bffde28488", "value": "3072:xql5GOoUEuTcGXr+vPO2aW4LED2z2aRtL9:xa5VoXzGXSvPtalH2aDL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623055, "uuid": "11a913d6-f0da-4c35-9395-f1d2bf0e594e", "value": 146844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623055, "uuid": "f3c6a65e-acf4-4f7d-9d30-4dfbb26ee582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "805c0d97-7f04-48a6-8620-7f978b80015f", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d616bd1-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623103, "uuid": "4998cabc-3f19-43ef-80ef-a4c30239b08e", "comment": "Malware payload (Mirai)", "value": "27465100a2a1c808f2c95476d4d6648e", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623103, "uuid": "4725c301-f9f1-403f-9aa7-b0d455161be3", "comment": "Malware payload (Mirai)", "value": "255efa49b5f90b17a358968921ac473ecc32b9968ee627da6bba5eee2c8086f0", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623103, "uuid": "abf2a977-a064-4846-971e-97a26f171298", "comment": "Malware payload (Mirai)", "value": "4fd2dac49445d235474db61bcdd9c0b74e1bcc8e", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623103, "uuid": "8a2f45ba-5b0f-46cf-b639-d30fc4b00c67", "comment": "Malware payload (Mirai)", "value": "d1667bf3689d47b522aef42cf155bcd419f0c905e5a34a19daa77a53e15c41c13cedfde83cc3fa4f0df495d25e28651c", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623103, "uuid": "aa77cf45-ac11-4a4c-adab-39f09c62fa02", "value": "T1D2A64B13F8A145F9C1AAD53189B29263BAB17C495B3123D72F50F7243F72BD066BA780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623103, "uuid": "d3f9fdd3-e4b5-4cc7-acea-75e02bc1b3f9", "value": "98304:gK4ZTmaDBGnJj7ZqIVlFQB5HDFyWZ1WxSPV1c86Tin1jEd:g/sjlqIMJFBZ1WxoL1wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623103, "uuid": "d2cf807b-df4b-4b30-9943-cb436c732a16", "value": 10174756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623103, "uuid": "093a1572-61c2-4b8d-81a3-ba0605e470a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623103, "uuid": "1714fb1f-095e-4ca1-a3eb-1f9d63a8f89e", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8282ac4-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621859, "uuid": "bb7b04b6-a40f-4561-90c2-4e235a1e9c61", "comment": "Malware payload (Mirai)", "value": "c4ffedd4d9d66338bf7f3b6f488d1f89", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621859, "uuid": "01374726-236a-46e3-8206-986432dce736", "comment": "Malware payload (Mirai)", "value": "263efaca6446363997f4b4522ef8f65695e20a5a55d938434dc43ba2fc0d33e5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621859, "uuid": "a08747b5-67c3-4aed-99f1-53190a15e1f6", "comment": "Malware payload (Mirai)", "value": "2751d0fbc1b304bb72c84cefda20b61928f978ee", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621859, "uuid": "7a40211c-21f6-418a-9869-a8889d0e114f", "comment": "Malware payload (Mirai)", "value": "3fd21836442c332c85e3b7decdfe2ef0b531b72cb800b6d8f48806d963631f79621ed481c11deae51d0e20612e4d8f7e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621859, "uuid": "bf731e3f-1e81-406e-96e8-9423104eeed3", "value": "T14993F64AB9429B01D59731FAFB8F425933536FACE3F97101DA246F6423CA9DB0F62112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621859, "uuid": "6b7af7ed-d57c-41b6-9bcc-a489f36fa830", "value": "1536:n7n05ZqssEOptbh6QjHF4MMaS1LetAq3ukI2lqmZoixIvLaBYwgeZJCBShu0:AHqssVD9DTF4MMaS1LetAq3PovLaBdJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621859, "uuid": "d4576fd7-5563-468f-ae96-9f932a75e3f2", "value": 96348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621859, "uuid": "33a55aa2-5677-4580-897b-4baa22d6104c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621859, "uuid": "5d407160-bd90-4c2d-8abf-8b0efb4c36f5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4631f484-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781650444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650444, "uuid": "5cba2722-464a-4e2f-83a7-bf654985b662", "comment": "Malware payload (Mirai)", "value": "39eb330344bbab8a92fc4f247eb2f9c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650444, "uuid": "4a4dd814-c239-4356-b00e-a4a20c24ff44", "comment": "Malware payload (Mirai)", "value": "26e189372eb012fd88d49f82d3013a7127551301074db38ffa3c5460514dcbad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650444, "uuid": "5c9fe969-eb22-48d3-88b1-b32fa4bdee45", "comment": "Malware payload (Mirai)", "value": "7a5c3af9f97e39f0f5fd0848728ceec6540aef92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650444, "uuid": "a7f99ed4-2d1b-42dc-a40b-b23b71c4a745", "comment": "Malware payload (Mirai)", "value": "50c52142ee336bffc0fbfe05f13c0eccc496023c689c1ad7e159719a354fcc10eb564f475f9a2ccec6c3dc0d65156de4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650444, "uuid": "1c4f2402-50a0-4030-b273-6b5d259290a0", "value": "T177635AC5F643C4F5E96705304137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650444, "uuid": "7ed0866f-313d-4931-a532-1f03cbcfd774", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGc+z3WyL35IUfA5PGFjfnPA:zGYxpTGASC4XT+yyLpIoYPsPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650444, "uuid": "72410fa1-6862-41a7-b5b8-341f958bf5b5", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650444, "uuid": "795facff-1642-48d3-93c4-8a3a3bd84e23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650444, "uuid": "ce55c992-2ad5-4b62-ac4e-785a599fd1dd", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5d6632-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781650508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650508, "uuid": "077d1d0f-ad0e-4183-a058-0409f2552c77", "comment": "Malware payload (NanoCore)", "value": "338ccded6845f7ddc81937b6fab60b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650508, "uuid": "bd801b28-aff8-417b-8193-bb673b527588", "comment": "Malware payload (NanoCore)", "value": "28bfd88c31c2f4c05bde5507d64e7362a1b9bb7ca98fb681b00dd9d9f130ce27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650508, "uuid": "8ad077c4-4734-47ea-bed6-58d5104cba77", "comment": "Malware payload (NanoCore)", "value": "74734ad73d5f2c0f1c53f19108c5c310112f5da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650508, "uuid": "69e386b0-13e9-4443-b660-3ab565a582f1", "comment": "Malware payload (NanoCore)", "value": "9b948e985cfb1fd17a2a51a565db508846ee3b05025247f83697eec163f1fa6c72eaaa504f9d1d319abbc9a48b5f0d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650508, "uuid": "5e9bd04b-e559-4325-ba49-f72b34130b51", "value": "T18C14CF163BA84A2FD2DF86B9711216178779C2E398C3F3DE28D451B39B667E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650508, "uuid": "e694ed33-0ff2-4a91-8940-57eb52616239", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650508, "uuid": "4260915f-dd63-4460-89cc-7b023f66a48c", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIdDXzMrrC/Y6jmdzBb6KaGaOCc:sLV6Bta6dtJmakIM5GkC/nqzp6jGaOiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650508, "uuid": "55a06e10-e552-43ee-bd2a-121f0ed64e76", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650508, "uuid": "b9a865bb-4708-4a85-b530-78e76f6473c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650508, "uuid": "2c533f5b-2f04-42c2-b33b-d0bfd0b3eea1", "value": "happygame.mobi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe38ae3-696b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781604685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "2e98bdfd-83f1-4936-b1b1-e1f06723e330", "comment": "Malware payload (Mirai)", "value": "16c2bf8e3e01b456831814d16c688390", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "fafd71c0-0cc1-44db-a712-599b1271ed75", "comment": "Malware payload (Mirai)", "value": "28c73742e86b67cd082c675d6df27bdbd9ed5e8241d626e55a82526645292348", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "81f22daa-ef7a-46e1-9856-0d570b214bb8", "comment": "Malware payload (Mirai)", "value": "2f81bb57f65d79ded7692b56246023e530d184cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "4dc5dde2-abf7-4570-ba15-cf914ee64ea6", "comment": "Malware payload (Mirai)", "value": "d61dbfbfc6108fabd56f73cf6075f4817362bb6109d25a1b19eda3cf3040669468a7cd0e2adc4289417b2de58e5f2874", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "76c46480-8dbb-461a-b2b4-ce24b22bdf27", "value": "T1D2C30845A9428B01D4D731FAFB9F429933536FA9D3F97201D9205F6123CAADB0FB2612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "258a3517-1fa2-420a-9d80-99d87fa9b343", "value": "3072:rUv6jrowEoVpl+BAClkT7Fal2VVybCw6QfyAV22/PH:rVrsHBAyE7Fal2VVybCZnAg2/PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604685, "uuid": "fb58ff94-9f8a-4740-a068-f7ca3acd0ca7", "value": 126160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604685, "uuid": "55a75ae8-4200-4570-88ac-88e0f8e63725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "22a28ea5-2819-479a-9468-06584ea91dbd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34b3a55-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605530, "uuid": "acc337d0-d08a-4a28-b9b7-3c9a5fc019ce", "comment": "Malware payload", "value": "94b70724df082aaced8b7215f18cfd56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605530, "uuid": "d114f0f8-b379-4327-87e6-58c7b941546a", "comment": "Malware payload", "value": "29eec382f447ae7f528147a448c2e7cf963f8dbdc747b7e61a49404f207f98ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605530, "uuid": "425a07d7-7f69-4c09-8722-76d50b00848a", "comment": "Malware payload", "value": "5875a8af013f10edb325995ee240cad3da72048c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605530, "uuid": "aa2055b2-25e4-49f9-84b7-140152166f54", "comment": "Malware payload", "value": "d10e0838557b6a8bf2f776da30ff955b5c0e7c4b12d3f730030d7d4d4856ad42a9428bd631d0e2713bf72a17671fb8f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605530, "uuid": "17b98caf-1b5c-4eea-bbb8-a3aaea6f34cf", "value": "T16F760157FCE228B7D1AAE231896691527A71BC483F3223D72A50B37C2F72BD05A75740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605530, "uuid": "beaabbe1-c498-43ac-83d8-cc1372302026", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605530, "uuid": "f6af1b17-e206-4dce-b3f8-fd05b6f9731c", "value": "98304:GTRsjHoKrfan9L4TmYN1yCa8uzyM0TXlIyifM7oltmmsquR3ryEfytfq+CB:GOjIKe9L4KY+cM0TXlIJf3ZsqqRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605530, "uuid": "fafa201f-6825-4625-862b-655ba49b03f9", "value": 7512600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605530, "uuid": "183bc46c-831d-4ff9-80a9-97b1e105faee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605530, "uuid": "e4104491-0489-4803-94e5-ebab95ef98d2", "value": "29eec382f447ae7f528147a448c2e7cf963f8dbdc747b7e61a49404f207f98ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd410518-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605654, "uuid": "db64fad0-40a1-473c-967d-fa6ff6a63a55", "comment": "Malware payload", "value": "6ae031c3a0540bd37c042e648ac0c1d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605654, "uuid": "837d73e1-c3cb-4bbd-80a2-e48d26372c29", "comment": "Malware payload", "value": "2a00f82e21a4bfcbfa9f42d0ddde4f2a0300da6ed107e60b714b9df00bf93e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605654, "uuid": "91fb63b7-a346-4846-97e7-f24d4eec80d2", "comment": "Malware payload", "value": "38513807fd1f0784becaacd7e19da95dbe99928a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605654, "uuid": "a965cb18-aab2-41cd-825c-429a2b4bb7d0", "comment": "Malware payload", "value": "981c5e9621172d20671733f904fbfac44a01d96692c2ad75201a20d9c3a1863c2de459d9798df66cfd0ca5ed1b14d1cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605654, "uuid": "4d082ae5-b305-4107-8554-261cb5df6a4f", "value": "T1F956F117FCE228B7D0AAA231896691917A61BC443F3227D73E90B37C2F72BD05A75354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605654, "uuid": "0bc3c232-d50c-40b1-b5cf-8aaf36038b8b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605654, "uuid": "126abbb8-3d2c-48ac-a42b-87dc829ba633", "value": "98304:GE88reFCRUgpN/MPe+9hGUdOInxBdKKWmKAlITvknA:GOKFC+gwP59Vzx+KBskA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605654, "uuid": "82a8e0ba-7192-476b-a8ef-6be31118689f", "value": 6140184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605654, "uuid": "18281d1b-9762-4b31-ad5a-da80923802cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605654, "uuid": "8e937920-7d5e-4458-8561-9ecd13b4c6e2", "value": "2a00f82e21a4bfcbfa9f42d0ddde4f2a0300da6ed107e60b714b9df00bf93e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4285038-698f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781620161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620161, "uuid": "2dfe3815-42fb-4cf0-8521-801c9e09da87", "comment": "Malware payload (Mirai)", "value": "336023b8b731cbd1025d503273744303", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620161, "uuid": "7f7de00c-ef30-4904-aec4-f79fd98bdbae", "comment": "Malware payload (Mirai)", "value": "2a42be71f1ae089c8d02513a48b9270e599f45d773000945d2042e6f3fd44929", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620161, "uuid": "4e77386e-b8f1-4762-bdd2-60a94d2e8f4d", "comment": "Malware payload (Mirai)", "value": "350e560b7d29b94237867a880f930e7b0c696255", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620161, "uuid": "131b9e3a-fca6-4bb8-88cc-ebb7a5b30bc2", "comment": "Malware payload (Mirai)", "value": "500b00ab9054fdfa3fdb6defb65ec53bca29177898e23ce5a293788477cd14a1524865fa5111553de4871edf311cdfda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620161, "uuid": "374ae6d5-3771-49d1-89b8-73c9e70a620e", "value": "T105D3875D1E238FAEF678C73047B74A24A76D23D622E1D684E2ACC1145F2029E545FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620161, "uuid": "2824a6e6-a0d0-4ce2-9c72-a558e0fcd085", "value": "3072:Ct9y0KnpzRH9FaVIrHlPVpL22UIKNg+D2wtgxDTTNJ+LJ3qd:Ct9y0KnpzRH9FaVIrHlH2zISFqQgxTNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620161, "uuid": "9face4ac-e409-4f71-aa35-06f6b56dd90a", "value": 138100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620161, "uuid": "142445d1-84ee-41ab-a5f8-237605867e15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620161, "uuid": "88a62f6f-6a66-4ced-9caf-9d3f00933c24", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81430dc6-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "d7b38573-609b-4031-91c5-2cba2dd72d1f", "comment": "Malware payload (Mirai)", "value": "1d2af67dbf598c0b5b4e7095a4bb8ea7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "cc6404c5-039d-45b8-98ce-622851356a5e", "comment": "Malware payload (Mirai)", "value": "2a8cddf2964a7781e9cca80bf8d66d3527e7677452003ece91380070b09dd170", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "e6a77408-9620-4b97-9e64-6d0ff83320a2", "comment": "Malware payload (Mirai)", "value": "df50e1901b6b051c812e3855f41c66af5c6cae4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "7741b5bd-c923-48a8-bc80-cc3ef11624ee", "comment": "Malware payload (Mirai)", "value": "550658d74f3cb2ace99f0ae095b5e1540da4a05ad7394dc64dd4eb31a44a0416726cce0bb2bf35b5e18b7c6e8549a917", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "79649a42-7ab7-45ba-9b61-960bcf38858f", "value": "T1A8D31A45F8504F27C6C612BBFB5E428D3B2A17D8D3EE72039D216F60378696B0E3A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "72c990a1-dc95-47eb-8b72-c33c5d78c9dc", "value": "1536:3prTQVGDERODVd2hms8zAx2Q4VxiYcT5XvrlhXdNOKB0GUOMFlOzwyw3R/sx1tN9:3prTdUr8z84S7NvrlhNBBDzpYBpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623055, "uuid": "971ebf57-f61f-40aa-8dd6-2ee51931f03d", "value": 137984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623055, "uuid": "bd988276-a4f4-471b-957d-267ddc40a7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "4e3c6ceb-97e8-48e8-9212-40b07ffb2614", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66e9ae5-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607790, "uuid": "51914c42-2751-492a-b2e1-cc43a17df6e5", "comment": "Malware payload (SilentNet)", "value": "3eded16468a3c2669af95226a7787514", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607790, "uuid": "cffd50c7-410d-4bb6-a077-75d855c12300", "comment": "Malware payload (SilentNet)", "value": "2af30cb2e7a3a5af213c4ea28ca895c494816a9550f322aa32497013d219232b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607790, "uuid": "6726f570-d43f-4f50-a01f-1f5458586ceb", "comment": "Malware payload (SilentNet)", "value": "17adf3473b0d3a8fe7e90d9d98304af368ca7944", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607790, "uuid": "17ac30c2-ffa3-442e-b221-06bce6389d03", "comment": "Malware payload (SilentNet)", "value": "d02138668ff857c9a774db5411c907beacc433fb01ad35c5668c2d309fb60539f5c15d2812f7b134e9eeedf40213380e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607790, "uuid": "96da0adc-0895-4c9d-9e90-44db67cb2563", "value": "T1DA94F11EFB1CC4A5DCA7C23BD1348112B87A64846876A133066B7DAE045E8DC7F1E6DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607790, "uuid": "fa3ba1d0-cdcd-46ac-9fdf-62a1d51b56ae", "value": "6144:jI3F2L6iX5FfZipi/vsnd3qW0DguwCB5dyMScYNBcNRck0HY0uhw6YD:c12D5F/3snEXD3d3UcNRf0HY0uhw6YD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607790, "uuid": "09a53253-4cc2-45ce-8b99-29449892e3df", "value": 429503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607790, "uuid": "6d7b359d-eef6-4dad-a890-87ad9ce54d4f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607790, "uuid": "4b9022be-f2e1-4d28-b974-ec0aea0ce8d7", "value": "XenoClient-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3564df1-6969-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781603866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603866, "uuid": "7d8b4502-1aa6-47b2-a9cc-56df5c6bc23f", "comment": "Malware payload (ConnectWise)", "value": "3adfb1123589caeabc71d3adaecb630b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603866, "uuid": "9665fc26-22c0-4b9d-9e0e-16781d8b75b7", "comment": "Malware payload (ConnectWise)", "value": "2c2ac25b1fa7891ca502f8a4e3146973e560c467cbfc9df395842d4a07854420", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603866, "uuid": "5a0bb7ec-f257-4087-8fa4-5291db1ee3a7", "comment": "Malware payload (ConnectWise)", "value": "ac4c6c27eaf4adce81f2108c560bb4da957d5c09", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603866, "uuid": "856f3ba7-b2ad-43cf-92a0-6b8865692406", "comment": "Malware payload (ConnectWise)", "value": "2bb9fc7f16b3b7d08f5de11dae6ccf4223ed3aa9a16c2966e1c0220583086a5d9f1e1dfe4af63683e51cc5f80ae376e0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603866, "uuid": "6890eed6-2d8d-47ca-877f-b57b38abf40c", "value": "T176646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603866, "uuid": "e8b9e0aa-ee93-4b65-8618-0aca72a7af44", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603866, "uuid": "85a1f13a-a4f9-4eaf-b9ad-0afe456cfbf2", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9cP1c:A1iw7gryNkSV1hy1Z1u2JLa9cP1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603866, "uuid": "bcb8189e-e6a7-4532-bcd7-a96c82ad538f", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603866, "uuid": "00043199-df55-4d92-bf80-786e10cfc0d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603866, "uuid": "b739616d-1c40-4ce7-83dc-cef7efcc0128", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e48fb03-6978-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781610112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610112, "uuid": "4c3c8fe9-0d57-414f-bb81-5e5547137f0a", "comment": "Malware payload", "value": "7918092f7b3c90b56645cfd0acd3db27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610112, "uuid": "294a18e4-9905-40a8-853a-0872323057a8", "comment": "Malware payload", "value": "2f41388b112539d7cde2f6ac3a02202c5f7deccb834c4caeb4f60ad5aa4c2073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610112, "uuid": "c8eb79bc-efd4-435f-967e-0f32916b1ee6", "comment": "Malware payload", "value": "edf14410909f594d28a78ce52ab930876b4afd72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610112, "uuid": "c9c33243-5326-4e21-b7d2-209f5b672e39", "comment": "Malware payload", "value": "cb05100b406b1ad5f8075cb9ceac83cdce60065f02979413e37d030410f7251c8f8b2c6ea106bbc9b120a1e7b7537128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610112, "uuid": "35da49ab-98a1-4afa-b747-5879dc994be1", "value": "T1501723C3B6EEA39CD0C31B00658613DB24D5A19AC6EE852D35CB5C03B511DAB4AC9F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610112, "uuid": "6d427752-5ad2-4984-9129-cafe6604bd39", "value": "d782fb7ac8ca006228da08b839d6df57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610112, "uuid": "cc740a5a-282e-4922-b6fd-4fb91afb697d", "value": "393216:oybOvAYv0KAGiRA5C8nySYxWfpNh/dgvt/AT/k66vxm0vQ:oyCvV0KpUAB+q1/dmUR6pm0vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781610112, "uuid": "ec8bc23e-55b1-4cd8-87a6-ad0581438fcd", "value": 19426400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781610112, "uuid": "d5fa00bf-2476-494e-a132-5db7012697ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610112, "uuid": "606db1d3-6885-4eb3-9a18-1ae693f942cd", "value": "crimson.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98c3ea6-6987-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781616761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781616761, "uuid": "fa7552ca-f169-43e8-a061-13fdddb6ac92", "comment": "Malware payload (Prometei)", "value": "b39e59e3aab610d9b20f52c5465ed333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781616761, "uuid": "a096ee6c-9fea-4049-bcf2-cb0ee6d75a59", "comment": "Malware payload (Prometei)", "value": "30b96d1bd5ab5e3e7e92de3fb77dcd7d71e1b2f8cd00121749e5c883431ee7fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781616761, "uuid": "fc789118-e95c-4bbc-8ca5-ca65b312ca14", "comment": "Malware payload (Prometei)", "value": "a8a473a46e63436ea4cc5770d63e164358c85ef1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781616761, "uuid": "c73d0f09-6737-4552-a9fb-f4f5b112ec54", "comment": "Malware payload (Prometei)", "value": "491eee49eba8464aff2bcd9235d85e07198a20650f67351f6b1c5a7978a0c723596d5cc0dc8728e2c0be9e34512d6bd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781616761, "uuid": "4ab076e7-de5b-4597-b24c-399da5614d38", "value": "T121A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94A34F3D732BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781616761, "uuid": "a7a619da-28ba-4e96-abdc-4ce7c8950033", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdWB:Fs6pyCC/Ya2hpi6T6N40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781616761, "uuid": "602eef72-8c89-47a5-83b4-bc73b9b36c1b", "value": 449088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781616761, "uuid": "38dbbed2-13a2-4959-b1eb-75129de3cd56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781616761, "uuid": "5e33651c-4e25-4d31-a6f4-8aab033e9b88", "value": "30b96d1bd5ab5e3e7e92de3fb77dcd7d71e1b2f8cd00121749e5c883431ee7fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb50e437-696b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781604685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "d4a264dd-59e5-4701-b0b6-1f81efbb4bc5", "comment": "Malware payload (Mirai)", "value": "10588eacd02393a5188b9f9529989ce4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "e98374b2-cd74-4733-96d5-cdd1d81d0227", "comment": "Malware payload (Mirai)", "value": "30e1549664a3158e5a4462d64ae45e8aedcfcd96b36986f2b548f4e30aac9c6a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "f830dc0e-affd-4d82-ade9-052fe865347e", "comment": "Malware payload (Mirai)", "value": "a3609a89102cca8638a5e0fd4036e16d0cc054e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604685, "uuid": "5a5f0563-91e9-46ad-b06e-1f61a39ec99b", "comment": "Malware payload (Mirai)", "value": "6c1f62db27d232edaa81bed8c7ef2aa9898eef75a26f9550de60aa7a08bda8e40da3acad971758fa86e009a39e16f4d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "9b895ee6-4cf7-498e-adc6-f348ced35c46", "value": "T185E31A45FC509F16C6D222BBFB4E428D372A5798D3FE720399255F203B9A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "210fc896-8e6f-4ab6-bc51-b16766e6c32f", "value": "3072:10HQSJ81FfRkc4AK/Ar9RsvQn4YXerJ2:CHQhZr4AKIr9RsIn4qerJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604685, "uuid": "a0d4e7e0-624b-4bff-bc56-61e2f91fb935", "value": 146144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604685, "uuid": "a358a13f-8c88-427b-8a10-38c1f867c619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604685, "uuid": "8e38d449-cb46-43cd-a47c-23ab39ad53a0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ff9635-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623057, "uuid": "eaf462b0-2e2a-4871-9236-19a85211003a", "comment": "Malware payload (Mirai)", "value": "bab57dd32f2884e831940b8232093359", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623057, "uuid": "1d154d1e-f750-48e8-bc0a-ff8a65ad23ac", "comment": "Malware payload (Mirai)", "value": "314a7bc8d3ee406b9ce7a61e10daf5405fe6171da3cd8a24c6ed977227cd51df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623057, "uuid": "102fe8dd-0c1f-4913-be24-60c354ea208f", "comment": "Malware payload (Mirai)", "value": "97e765e159d7c9d1af19a13b8e2260a2872490e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623057, "uuid": "3c13145e-dfe2-4808-852b-627576f174b0", "comment": "Malware payload (Mirai)", "value": "443634252d8911d780cb3ea5fef2cb99eeafc26dc25bb5d3d8296d76bf52320e1f766fb7e980061146f43b096a75dfeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623057, "uuid": "b75d808d-ff44-4b1f-8432-c947de10a318", "value": "T1D404981A6E228F7EF668873047B74E25A75823DA27E1D680D1ACC1145F6039E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623057, "uuid": "420697fe-cb50-488c-b879-eff923a543b0", "value": "1536:OBs59EnnWRrZ4E1HuyFYc/J6L2G+saBQs+1ecgV66uKCHTwn0PO0y4UiaGilyKn:5LEnW7SL2GFaqs+RgVTFyO0y4rVayKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623057, "uuid": "6bef3cb6-22a9-42fc-bb8a-ba2814f90d10", "value": 177740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623057, "uuid": "160c9a19-fdab-4d24-b7ee-5dcf59bc76c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623057, "uuid": "6cf8bcb7-b39d-4652-a0af-ddd0b1ec3932", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2800e10b-69b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781637938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781637938, "uuid": "d4d77208-90e6-42f8-94da-c72731188a38", "comment": "Malware payload", "value": "c566c8e62ccfd1e26e81c41ce73793f9", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781637938, "uuid": "e2b4d051-a41b-4a2a-9f43-f03ab14b9954", "comment": "Malware payload", "value": "33ac46240cf7da47df5b0cf03706aeaa22cd8f199c442d12d1826bf19e654613", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781637938, "uuid": "8aaeade3-eea6-4941-bc3f-a03f7971b590", "comment": "Malware payload", "value": "7a764a5d61bf74272efcc724f7f9188f502a5fb5", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781637938, "uuid": "dab85306-3657-457d-b777-75cd0187714b", "comment": "Malware payload", "value": "20b31df3991a7c1ce6c18bbbdd0c2db4ab3e9822b5afa95673ce5908e6debb07f8244ec0f2e33fdbb5755260eda094b0", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781637938, "uuid": "60f0122f-09ac-46b9-a769-470399f04018", "value": "T1126370763A0CC643FB4481FAF01049C5083177992FA551E3EEF9AFA53E2F9A54A19378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781637938, "uuid": "141c3fb7-90e5-4ae9-b74e-088668261ba6", "value": "793d5e12fbd00ed7abfa28e603970f75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781637938, "uuid": "c7e13d5c-9bba-46b1-8ee8-346d59b5918a", "value": "1536:xU1RqfAGzVpg+GmWxphpoSRH5xen2Upc2lzIO:xU1Rqf7EhxzZUpcmMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781637938, "uuid": "67f81b4f-8797-4949-9ebd-8d46f4cff6d4", "value": 70384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781637938, "uuid": "5bc9ccba-8936-49a9-bcf6-f16ef581923d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781637938, "uuid": "68af6684-5567-455d-b4fd-5fe82c8dfa49", "value": "Load.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b665ffac-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605535, "uuid": "af9a391d-8418-45a6-8344-809711875b58", "comment": "Malware payload", "value": "7af4873a2c5c95f0b51cd625fc867be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605535, "uuid": "1c2a0869-bd1f-47a7-81af-407d2ae25733", "comment": "Malware payload", "value": "33cd6284e1a5c6083699ea58d6bb60a012dd0cf6746499d9c8da20076ffe525f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605535, "uuid": "0a28bd18-16f3-4e24-b96b-373dd29031b3", "comment": "Malware payload", "value": "50eaa99b0bf398bd27b6ccb4f9886839779dbd4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605535, "uuid": "f7e22c01-3043-40d1-b559-084caf89e4cb", "comment": "Malware payload", "value": "58d6b65f1ace1a95ffafdfb8ee9a9aef62574029ac5a476ad29975670d2708b27607a98c7f4b7cb31dcc02b10e121034", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605535, "uuid": "eeda525a-055c-4f64-a2a6-09043baa4951", "value": "T1E556E11BFC92E8B6D0ABA231892351517A717D053B3127DF2AA0B3782F72BD06975770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605535, "uuid": "fb042061-b551-476f-88f3-c57821055128", "value": "fe9fea8fb19fd7848c8e645e3ea33785", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605535, "uuid": "b64e5266-9660-42b9-b72f-e7ecf40d358d", "value": "98304:Xs8N9MkMbtID9pWk86X+fqnkquiFB/mgk5vfTf3JzzVE:XD7MkMbtIP8wQqPuiFtm35HTf3ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605535, "uuid": "e01e3716-d294-4c5c-83d3-9cf797b5c196", "value": 6125064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605535, "uuid": "9081c074-04d8-4ac1-86d8-18a577363279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605535, "uuid": "6e987073-e241-43fb-8bc8-aa59443073f7", "value": "33cd6284e1a5c6083699ea58d6bb60a012dd0cf6746499d9c8da20076ffe525f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8f3157-696b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781604692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604692, "uuid": "f7a32707-14d8-429e-baef-58a334b88256", "comment": "Malware payload (Mirai)", "value": "64ea15e2b0cf563fa792f39b9e985964", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604692, "uuid": "87370dbf-1b74-4a7a-beb5-ca84b1056e89", "comment": "Malware payload (Mirai)", "value": "348a82709d9ddec8cd56b8b2c55d7793bb99c2ec0d52cb0c388e7485178486ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604692, "uuid": "4cbb78d4-fb8d-4a7e-922c-48cb20de542f", "comment": "Malware payload (Mirai)", "value": "514ba42f36c1371bf69ab226c6eb1dcd9b3d9369", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604692, "uuid": "64a84e76-4c42-491e-a259-bd82927fe2e4", "comment": "Malware payload (Mirai)", "value": "19e59c6263d9f448b3c3f12a1b49d7ab5b0ea96e3a3c0872628b20e6a97f1d296a8de4486638b5e01d83abdcfb3b69f9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604692, "uuid": "c6f21bdd-3baf-4d0f-98eb-ce7003b1556f", "value": "T1B5E35B1AB5C09CFEC899C1744FEEF536E972F4185138B15B27D4AB626F8EE201B5DA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604692, "uuid": "54a164f7-4933-48dc-ac1f-f146a6e0e8c8", "value": "1536:p6zSfP4mgBrCO125B7klVPzgIj9j4bQezTscXAG+EPvnzPbUvcgC8npljdN3X:A+geN5BA/zgM2TVAG+EXzPbUJCULPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604692, "uuid": "529fcf14-1e8a-4ecd-bd1a-d446c7bbbdba", "value": 155816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604692, "uuid": "2deac729-52b0-464f-ada5-a7cf987b390d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604692, "uuid": "82b66e1b-0adf-4c74-99ba-934d70ab5323", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d596e03-6931-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781579616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781579616, "uuid": "abdd6352-7cf5-4e39-a0e9-a9be589f0ee8", "comment": "Malware payload", "value": "3ec0ea3d1bed10e4040078c37d6451c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781579616, "uuid": "6a68f4d6-e6a3-4a9c-a99c-a6b424c59820", "comment": "Malware payload", "value": "34a73cb9e6b1fe0332c59ce38608c729b37f58653840a2e67ae082910d64b8cd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781579616, "uuid": "cd35b5cd-64da-4eca-99bd-012c79d76e69", "comment": "Malware payload", "value": "1eb3bbd9393cb4af07c73a1253a93049c185238f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781579616, "uuid": "4f4ef1ea-bcca-4837-b746-706e45a4afbb", "comment": "Malware payload", "value": "da240027a00799008d53cd393e3fef3e56c3ddcb8d583006cd481fdba45c6218dd46735ff17d6c164da9308e7e1b4569", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781579616, "uuid": "59e807a0-4421-4121-b40e-d7d2f6f77e1c", "value": "T120136D6566853C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781579616, "uuid": "e4711911-49aa-445b-a19e-6312fab45652", "value": "768:3XRWNGxVo9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:RlxLco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781579616, "uuid": "70e1bbaf-e13e-44f2-969a-647248463ea2", "value": 45497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781579616, "uuid": "7f5bdcce-322a-4dcc-8538-0fb50d8e49b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781579616, "uuid": "ce25299c-de61-4575-89ea-12fc7e893926", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3007400-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607758, "uuid": "0f22e9d5-baa3-42f2-8bb8-50bbbe0c4b75", "comment": "Malware payload (SilentNet)", "value": "9c549735220e9b1d974e883d64114202", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607758, "uuid": "d5ca3e41-f632-4245-8862-b20247de6f4a", "comment": "Malware payload (SilentNet)", "value": "3519fa98f51fa7aede0dae4ec5a53d7a353124275c476d5008584eb3aba66416", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607758, "uuid": "97f0014d-acb7-4004-b9b8-70daa39cf227", "comment": "Malware payload (SilentNet)", "value": "de39bed395a6f41d51e49bfb5b1ec4e6108bd955", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607758, "uuid": "b1234228-11cf-4f05-991a-5107aea060f3", "comment": "Malware payload (SilentNet)", "value": "749d5eaeba7c1967cb71fee51f1da4d8f251be488759c14919e6bde87baf553e3ba57ab400ed5c9cd0bab76c82dbbce5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607758, "uuid": "0486c3e9-cc02-4e6f-9b6f-949c074755b1", "value": "T1D345226A7EEED97CE123D2B88C14916A781C55C8E50AE03B15E5349F6C24C0B6706FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607758, "uuid": "1a98cf72-6ab7-48a6-893e-2e814f9a3f16", "value": "24576:uFTE7Xq7a3/c+MSz5q7GT3Edmbk68ldIFVsKQNCP/z7FsWmp/0nl8y6IGD:r7ka3/cpSz5REHHB/NCP/FiqliI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607758, "uuid": "bc922da1-8296-487a-a8f8-767029ba8e1e", "value": 1232817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607758, "uuid": "fc28f2d8-ce39-40d4-8e8a-70282a7cb327", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607758, "uuid": "d2f7cc46-d42f-4479-aea4-eefd8dc6937e", "value": "Nyrex-client (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce267d5a-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606864, "uuid": "0b20cf98-1ba9-4ae7-af1e-2c3ea3971aef", "comment": "Malware payload (Kimsuky)", "value": "6c7efdbd2861ce76dd6bdcaab5ac1ea7", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606864, "uuid": "ca46eaf0-e81c-4dc8-8e07-397d345dc392", "comment": "Malware payload (Kimsuky)", "value": "3557d97f4e7bd9081558c830f84570ad7b5b3b02d3a6902e2678279b0c932176", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606864, "uuid": "e2e595aa-a95c-4424-94fe-8055bbc4a70e", "comment": "Malware payload (Kimsuky)", "value": "53651b48d967092ab2235e548be935930423f2cb", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606864, "uuid": "c35f0d79-b00e-4d31-bc5c-83279abd0ef3", "comment": "Malware payload (Kimsuky)", "value": "79f032f082cf77ca1b99cdc04138c4534da23827bd1ce21b659aab8091ce442aa4d2378d200585ff40acb33e86d35100", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606864, "uuid": "0d5deb03-8c39-44a3-adfe-40bbd4115b82", "value": "T1B5839D3C4E5E6E2BDE3CE2B215824253B081ECE833659D6551CB16DAEE5042470BE3BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606864, "uuid": "4b09f8d3-6314-4b73-bcb8-f78a1c1e8fd0", "value": "1536:iv4PkH+Wi9ugq7Ow8BroavJA0/VD6D5Tt+Aobzmd94:igPk+WXgqiwGDDVsJaXmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606864, "uuid": "d309ae5e-d5c0-488f-aeb7-42763d9043d3", "value": 86969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606864, "uuid": "07b3a4a9-f881-4789-a440-d014e805282a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606864, "uuid": "0a4e699d-d698-472c-88fb-afce8f6bd83d", "value": "3557d97f4e7bd9081558c830f84570ad7b5b3b02d3a6902e2678279b0c932176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2580c05f-697c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781611735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611735, "uuid": "b3b69317-7b8c-47e2-8d9b-2f881710793b", "comment": "Malware payload", "value": "e79cac0d846568496aa2f93bf329dc85", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611735, "uuid": "f57a9125-adc7-48fc-a7b8-cdd4a618e522", "comment": "Malware payload", "value": "374d9d67707ed788f66fbea06e94f8045c078c79e9fee84f0e891a1e3f5681a8", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611735, "uuid": "702c9670-dba3-4e38-ab28-e49fad892cbd", "comment": "Malware payload", "value": "14c1fe20ecc76ecd49a7dc211256a3049e35d489", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611735, "uuid": "ec9b8959-cb20-4714-923f-cc6ca8d83a9a", "comment": "Malware payload", "value": "cc26e39a6588be7f434d8ab12eb4db3936eb815207131e4207418b1c95af727f7a2d982619cb4485cb68e747844dd104", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611735, "uuid": "4aa9d654-dd34-4823-8e35-24a9a6eb8cef", "value": "T1D4D40121F581A90BCF5A1F3197D396E62705FDA19E7E821B6101735E1EF3790AC03C6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611735, "uuid": "0e32371a-ade6-43d1-9515-955b341b91ed", "value": "12288:HQG2kUcyM1DvcIi9PQvUJHoocOT7wiMbn/1Cj2D:HD5box94vUi+0NbnUjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611735, "uuid": "e9da98fe-92b7-43d0-932d-beab59e4704d", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611735, "uuid": "9ac30011-4018-453b-8b0b-9cc4a381d930", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611735, "uuid": "9024213d-76f3-4b0d-b71b-5b56096fd35f", "value": "Nalog za nabavku No 1100 16 06 2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038e1be4-696e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605665, "uuid": "2b1204db-9f10-42d6-bf58-483b353ea0c8", "comment": "Malware payload", "value": "3ead53a93bd83233e14337d64cfcc5c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605665, "uuid": "8b464385-bbc1-4d60-a688-7be6e6cae277", "comment": "Malware payload", "value": "3785ac1f0c4d0ba6befb85db78e61e0ec7f6fcb1e06b610f3e1097a40195cea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605665, "uuid": "e3789f9f-29fd-4576-a7d2-7d15099e1e04", "comment": "Malware payload", "value": "21a7206fe0436987791f133c9f2fd4eeb216da07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605665, "uuid": "79a20abb-ecf9-4eb0-8d99-82873412ce82", "comment": "Malware payload", "value": "3b6c3cf9f6ce2d711544418ddef58b03e1080f94dcb22d4fc5a37595ec2a95dcbed0744d85ad388f323b4f28357a7e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605665, "uuid": "c7659d47-2856-4427-a97e-de7d2eb2a177", "value": "T12B46DF47FCE109FAC0AAA2718962A1967B71BC051F3123D72E60B7382F72BE06D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605665, "uuid": "36894662-bdc5-4f02-acfb-1a94f2b2e663", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605665, "uuid": "1a7c9389-7cd7-45b1-965f-49ddebeb6820", "value": "98304:fXXG728OKMTq44ikXQ+IqqO88/XMp2ARWKlTp983:fXWOPr1+Ik88/Xpq9p7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605665, "uuid": "edc96408-40b8-4398-9b0b-7d18cc23e55f", "value": 5430944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605665, "uuid": "d0355120-c3af-4d80-b335-fd8fdc78495e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605665, "uuid": "c3c7dc81-2f4a-40f8-8010-913b5e300344", "value": "3785ac1f0c4d0ba6befb85db78e61e0ec7f6fcb1e06b610f3e1097a40195cea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72041776-69c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781644934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644934, "uuid": "17ab91bc-190e-4eb7-8b6e-bb3ca6d4d62a", "comment": "Malware payload (Mirai)", "value": "083e59fbf99b73594e6125e3182b4f4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644934, "uuid": "bcd58052-6a94-4509-b3a6-3d4b90dd0bd4", "comment": "Malware payload (Mirai)", "value": "3892bb4b2e6a0d05ac0a62fe1156db84b31655bab5f757411e058f832a2f8843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644934, "uuid": "b1ec09ee-c102-44ae-9696-05e359befb1a", "comment": "Malware payload (Mirai)", "value": "12a18aecc87edd226c51566a7d6990f5a7d519db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644934, "uuid": "0ba921a4-1be7-46cd-bcf5-bcebbbc58387", "comment": "Malware payload (Mirai)", "value": "c52fa215845abd08835214a52f6fcb2d7e1cfd47ed24a61ff1ee625b2888808faf9983ef6d1b6617c5131232adddcb36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644934, "uuid": "66973f0f-17b7-4e39-b553-9bbc5b546c38", "value": "T15244C7193A21DFBFF56C86304BB38A2057D935D62AE19746F25CD71C1F2028E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644934, "uuid": "8791b797-e479-4f14-a5a9-053da14a9590", "value": "6144:rS6ZK9nYy61TJy1Y6Tsg6bT+Zy7K9mtwAL4mObI:5ZK9n5BYuszbT+Zy7K9mtwAL4mObI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781644934, "uuid": "1b61f9b8-a45c-48b8-be78-a05df50caf9f", "value": 253587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781644934, "uuid": "15441b8b-8ce0-4a23-9530-70d692557c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644934, "uuid": "1185a408-9271-4408-8ee9-895b4654a843", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1a5f67-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623047, "uuid": "d9962c9a-457f-4760-9ba5-95d392191f8c", "comment": "Malware payload (Mirai)", "value": "a86b127840579757abf62c152cacf64a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623047, "uuid": "35daedc5-9536-44c6-95a4-e68e3476cb5c", "comment": "Malware payload (Mirai)", "value": "396470ecdf931da19299a712aab633d51e064e062a8916ce6c6c3db08236e7a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623047, "uuid": "e2fa2a09-f85b-4cf1-97fe-1d22c8bba820", "comment": "Malware payload (Mirai)", "value": "482c0feae48c0b5f8f6b2ced14725561e18c5cad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623047, "uuid": "077f8bc7-961b-4973-b52b-13055a2384ea", "comment": "Malware payload (Mirai)", "value": "a9193027c5a66f48fccc10b5e6a03e2366ddcf561bc8e54b2ab2a1ef48ff34bc168d1f506489b45bdc348ec8c77f38b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623047, "uuid": "6c1f662b-4e47-4a1b-a9c9-0addbbd5c58a", "value": "T158211FE7A5859D9ADF34D53C8A204321BB56ED29C50FE38A4D149199593328C1A840A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623047, "uuid": "65893615-fee5-49f9-91a3-fd5487c89bb0", "value": "24:7LkAdGtlH4rUpTXtWpGG2aIktmEJmJuSdikC7m1fuONfeJ:7L7dIH4rUpTXtWpGG2hEJmESs772flNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623047, "uuid": "a09881b1-c51d-4a8b-bd11-9704634398ca", "value": 1200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623047, "uuid": "ab981493-effe-41c4-a79f-cead4ca5a1dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623047, "uuid": "16eb91de-7834-4a6e-9d92-2a0bbf97918c", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc3e7e2-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607747, "uuid": "c5c9efda-c5e6-499a-a890-c279455b213d", "comment": "Malware payload (SilentNet)", "value": "e30d74a3d73dad79ab6f7b7e92ea99aa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607747, "uuid": "88cbc82c-d6a3-4b07-908c-e92f9196760b", "comment": "Malware payload (SilentNet)", "value": "3a89ee993c2a68ff7c9e2d911de7bd61a4791f8dcadf658023b3095dfcccc5b7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607747, "uuid": "ab157142-0618-489f-8501-827e7e26b088", "comment": "Malware payload (SilentNet)", "value": "0fc521b5d0cae8252fa485fd33b4ad6daa169e92", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607747, "uuid": "3bd3d745-f9a2-41a6-bd80-a8f60819901c", "comment": "Malware payload (SilentNet)", "value": "10a3072479497ebf5af4a83e96fcf2ac210e539536c885ee28d6872f9aa62671d006e96aa2a8a3870df2b6c15998842a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607747, "uuid": "6051ebd6-7134-43ba-9b27-da392801fe81", "value": "T19A26E114AE5D403DE853EB338041E0E175BAEF99510BE06F2AB9054D48F4E478B7BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607747, "uuid": "64f5245e-ff8d-47ac-bf5a-9b87fe080a25", "value": "98304:eq2SKrA10Vma9yCGYfwTKKRU/2uVblB6/th85xEz4G:eq2C0Aa9yCGQ/2sO85xFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607747, "uuid": "ba674a5b-230c-471b-8175-7f6e7dc19d98", "value": 4701265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607747, "uuid": "7cf7d2ed-b59a-48bd-be62-a06522d599c5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607747, "uuid": "aa77ad1c-5345-46d7-a5c7-481cde807e73", "value": "Meteor-Client-1.21.5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6f4354-697c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781611775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611775, "uuid": "2e5a26b2-6871-406d-8ee6-feadbc6469f2", "comment": "Malware payload", "value": "03888df9f2d78fbc8a92077520cf1846", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611775, "uuid": "b5fc879c-d655-46b9-880e-71016329926e", "comment": "Malware payload", "value": "3b64a98102380db428a52754fb2f61a44d070a50c125f6de9135af6aa0824d31", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611775, "uuid": "79f2d165-f2ae-4ba7-a25f-3736ff666c55", "comment": "Malware payload", "value": "3b55f211f9b99b3c6d5091185bf28ff4d536661c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611775, "uuid": "34cf017c-230e-46c4-a53c-9bba287e95b9", "comment": "Malware payload", "value": "c4ed33f50a5c7d75a3e2b4416883573b3b725fe213b47dd03ab3d26e36cc0a5ed92c26fb72d3caa14ea93a75f6ce8982", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611775, "uuid": "db91efa7-b24d-41db-8484-a1bc528d344f", "value": "T18DD46D10DE34026A4F8B17B9FDE44B56CABC8618562690F5FADE070D61024FCE3BF669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611775, "uuid": "a9c2fbc9-ea3f-47a0-b5ef-69b378ffe7f8", "value": "6144:LhUC6hUC6G4hUCjhUCDhUCEhEhHhUEhUCUhUCWhUChghUuhUCT6hUC1hUCYANhUE:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611775, "uuid": "43100b94-9ac7-448d-bd90-9fd3d67f318b", "value": 622927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611775, "uuid": "8711ed87-5018-4405-9de8-c9046372ffb3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611775, "uuid": "ac1281f6-c769-4c41-9ab0-4d55dfad12ae", "value": "Justificante0089.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19ada78-69c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781642920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642920, "uuid": "c2b0b53b-6fa3-4b96-9255-7b5952ce0ed5", "comment": "Malware payload (Mirai)", "value": "45e59ca819ef84a642cc4cfadbbf25a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642920, "uuid": "de789df3-8e55-4942-9393-ed78c3829050", "comment": "Malware payload (Mirai)", "value": "3d3d3af441e19c563ff779a25e07f68b9ba86a0760aa2deb08e88494d4187c11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642920, "uuid": "09e09727-3f65-4ab4-a025-a0668ea19b6d", "comment": "Malware payload (Mirai)", "value": "51160b2391b7c131202b047cb5438d48ad53ae8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642920, "uuid": "e121c345-86b1-482e-b781-a17860f9a848", "comment": "Malware payload (Mirai)", "value": "c74ec814b9c9c926a196c1ab364c2d9d08cd380726efdede73cfdb176d12347da0001847278eb21df3e332917203de4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642920, "uuid": "7b8baf7c-821f-467a-8426-d7e1f9ca34ba", "value": "T11554F80AAB610FFBE8BFCD3742E90B0125CC581612A87B767574D918F58B68F46E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642920, "uuid": "bdfd645e-01d0-4ee4-bd06-c59c9a67bdb7", "value": "3072:lIJt7cCxaUoHTGwDiFKgAXPos3x3IfUhn3IydEcDICg2F9tp:GDRotzHDjgAwYB2Uh4VSICgeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781642920, "uuid": "9520f152-6529-42f3-8371-b4941b85a739", "value": 278680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781642920, "uuid": "b73a0e2e-798f-4289-ad33-b69081987670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642920, "uuid": "8b51baf9-40e8-4e3c-afc2-6efbcf367d17", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826c9bcd-696e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605878, "uuid": "75a60c99-88a8-4586-b3be-5cd72f8054ef", "comment": "Malware payload", "value": "83fec7f2f14647bcb138696be871cc5d", "object_relation": "md5", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605878, "uuid": "3d135f90-bc00-40f1-aa41-b01306b94dbd", "comment": "Malware payload", "value": "3ee9221738c121535faa81d92c62605ee479ed5b8f0016afe96891b7d65d422b", "object_relation": "sha256", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605878, "uuid": "8c56753b-635e-4b93-aea4-d95f55fce011", "comment": "Malware payload", "value": "1ae3eaf3991601dc91e703082215cb9b21e4c5dd", "object_relation": "sha1", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605878, "uuid": "e94c0422-ea66-4ab2-b1a2-e420c4da130f", "comment": "Malware payload", "value": "57e6f27ab00436b085d2454d8cf674423904a3aa3c9ed4e78a3ac4665b3b6840124e39f997e75bbfcada3f9b52321216", "object_relation": "sha3-384", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605878, "uuid": "70d87ef3-cdee-4285-b954-cd9493719199", "value": "T167567D13B7C4643AD4A71A3B8C3BA648683FBA612E15CC4B7BF40A4C1F396816D36757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605878, "uuid": "86d9295b-57e7-40c8-b7cf-33536795bfd2", "value": "0a8c4a4f37cf3c0ef08dbab272fca40c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605878, "uuid": "e8d85a98-6819-4ecf-b507-b23f2af5b732", "value": "49152:UWJsZT9OMhuSgA8er7lWzHLrMsgMlv+XPs9FEVl6c6Z2UREjGWNVFPN8S:3Jsx9Oq0XrMElmfs9FErP02BFiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605878, "uuid": "c8f92628-a116-4048-a4eb-1bfe68c1ec94", "value": 6087168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605878, "uuid": "8edd4ffb-3a92-4441-97ed-eacaa76dab00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605878, "uuid": "9f60624f-c3b8-4e76-8cc4-206a726e97af", "value": "3ee9221738c121535faa81d92c62605ee479ed5b8f0016afe96891b7d65d422b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b39c31-6997-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623633, "uuid": "2ddcccbb-5144-40e3-88dc-6baeef3c7680", "comment": "Malware payload (Mirai)", "value": "411d8d859ce7acc709e1b87c32afd0d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623633, "uuid": "43caeda6-a089-4aa7-8669-0c25465652fb", "comment": "Malware payload (Mirai)", "value": "40f131490c0b18e57522cc15c930f400472d3184dc74a7f4e32025c8b3328d69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623633, "uuid": "2077914e-1a46-4f23-a415-cf67a22ef3ee", "comment": "Malware payload (Mirai)", "value": "e21ed2a6fabfed1722badc060a51de489d221e03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623633, "uuid": "60e30658-9dfd-4ff6-9a26-0f0b3d8191d3", "comment": "Malware payload (Mirai)", "value": "254508d4ff4dd02cd06abb63d1b3c70cf2932670e020d986711a5bdb1297304832a30c56ebeee20aea4ae0f0c245beff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623633, "uuid": "46af6319-28a5-4ec2-ac91-917a7caac0e5", "value": "T1B0930289B0AFE8A6F45EDD7D034C2482D5083A9163FF12DC2B974945FA62E1C198EDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623633, "uuid": "1adc867c-d464-478c-8c18-9c83101e6c6e", "value": "1536:yq2XfF2A5j4vB/4bcL6/Lv93kVwotvbjyStK/RUGV/FRDN5Kbc4:yBXfFyparCwYvySo/R9bDqbc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623633, "uuid": "8c1712e5-73ee-4277-b12b-4b3fb9f539dd", "value": 89460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623633, "uuid": "1392455e-c191-466b-9676-4da899aad61b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623633, "uuid": "95618346-57ca-43d7-9dd4-fae025d7ca3a", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802e416a-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623054, "uuid": "98622ce0-df2b-436c-812f-76cf6c0ff6ac", "comment": "Malware payload (Mirai)", "value": "639bc30bab321c821c3687955afb033d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623054, "uuid": "d2f42a21-3e54-46d3-97a0-9bbdae18bfab", "comment": "Malware payload (Mirai)", "value": "4122d51f9e5e99506fe228b1857acd21e0fdc092790770b13a1726c8e6959bea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623054, "uuid": "36dc7ec8-6a35-4496-8cb3-5bbb7b158ffc", "comment": "Malware payload (Mirai)", "value": "06a8809d3fcc48a87d49312c18ef9a86700a4a0f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623054, "uuid": "3d54a9b4-bfb8-448e-b5c5-e82658b7fa65", "comment": "Malware payload (Mirai)", "value": "9c59f33a2ab1f98fb8898324070254dc5d48ff723558d25a51ed23293f88f9204632a27c5e2c718c6e47650186d95bb3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623054, "uuid": "62b0a0ea-4423-457f-b77e-65e215dcb09e", "value": "T116D31A45F8404F23C6D612BBFB5E428D3B2A17D8D3EF720399256F64378686B0E36A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623054, "uuid": "e0d4e7c8-0285-4bc1-af10-cdab3b5fca00", "value": "1536:cducJvG5JNLJhTxo5w/OWdAESh4VmNjTmGEbV/uBP6J0vF/TFzElP+wywOQREtZG:cd/S9oSGWdQ4ejebV/gkuFp83h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623054, "uuid": "c0f055c7-c445-41c2-93f7-b16c587e615f", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623054, "uuid": "d7cf332f-7536-41f8-80d6-911a23298bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623054, "uuid": "ff6ecb21-8b5c-4d1b-90c0-007043adf5dc", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7d9280-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625601, "uuid": "6085d6af-cea7-4c96-b365-f9bc786507a8", "comment": "Malware payload (Mirai)", "value": "c5a0a23d5f99bd1cea4d7b8f777f1615", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625601, "uuid": "dc6e7086-6c7e-479c-bc63-b06c18f6db48", "comment": "Malware payload (Mirai)", "value": "43b5ab7423408f298026435733151fbc031c8f00ad9e6e6b43f3987cace89620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625601, "uuid": "13d0b40c-95e8-42ae-a701-a0c6f6b61ea2", "comment": "Malware payload (Mirai)", "value": "a1e8d703497f3f8cb7e8ab7265d87d65d3678d78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625601, "uuid": "e2cd9a40-3372-4b94-909d-46b6304cb753", "comment": "Malware payload (Mirai)", "value": "40008e2f6d07fc474b25da28ea8310aa60d42e8d086b352e2393fba004dd6e36121987b1d5f1cdad9857ef521e70f7ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625601, "uuid": "bdc61625-d861-4d63-ae74-a0f291a94acc", "value": "T188234B22B9391E17C0D4A9BA22F34768B2F5074E29ECCB1E7D720E4EFF1095065176B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625601, "uuid": "8077de78-d8f0-4e3f-b5a1-0dcd36d980b6", "value": "768:Yo51srhq9U5PrY3xChVAkUxIH7UOne4S0dQO+Ne/:YemrhSU5PrY3xCTAkU2LnsNe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625601, "uuid": "922dc07c-f621-4386-8ea5-bfa59c618b84", "value": 47228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625601, "uuid": "1fc9b24f-e7ab-4ed0-87df-d990f2594660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625601, "uuid": "d8d96844-07df-4ac6-bd2d-ac963b4c8f17", "value": "2fb9dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b0454e-69c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781644482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644482, "uuid": "3c4cb8ec-df5a-4012-a201-6556ceca17fe", "comment": "Malware payload (Mirai)", "value": "84962040a4105a05cce9ffe6ba8a19cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644482, "uuid": "7c97818e-048a-410c-9ec1-f6610ba0090b", "comment": "Malware payload (Mirai)", "value": "43fc683aa6c8e087256870ea735557686fc62a557ab57495cd48f1d41cfc9fbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644482, "uuid": "0312a542-28a0-4c72-86bf-97765766b416", "comment": "Malware payload (Mirai)", "value": "2bd94575722378887bf27b53caa215d73a8839e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644482, "uuid": "6c72c778-4a14-4461-b828-3e6ba5774c5d", "comment": "Malware payload (Mirai)", "value": "7bf011e35d3d8c238040b7250b05569998c44e55698fa3e3af2f0302b3285b1b073441c60bef47b6ec48a3df27c941a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644482, "uuid": "7aa86ac8-1290-4ddf-9fa2-df595e108b2d", "value": "T111544B46EB404F13C5D6277AB69F02453333A7A4D3EBB206D924AFB43B8775E4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644482, "uuid": "8172b5fc-5764-42c9-aae3-764cc2e657d5", "value": "6144:pL08NOu3wnZW3vKSl+3aXyDAcfcwyVgTix37naIMZV/Ggmsq2aZXs:pBFAuKSluaXyDAcfcwAEI37E/LmdzZXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781644482, "uuid": "0624203e-e4d9-45a6-ab98-1970e12ef9f3", "value": 286455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781644482, "uuid": "e7bd2caa-4535-46b4-ade1-fa670950d5ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644482, "uuid": "c658dbcd-56e0-46dd-b4e6-f6d2f8af8f50", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9f7b80-6986-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781615988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615988, "uuid": "f5420477-6a69-4f07-9ae6-b575ebb63705", "comment": "Malware payload (PureLogsStealer)", "value": "2f9a1632e2fe44b3d5341af036082086", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615988, "uuid": "f5d6e68e-9e2a-44e3-8abf-cb4b48236efd", "comment": "Malware payload (PureLogsStealer)", "value": "4554a86cb3ae160baa31cb72bf80246ae0a98efd5bd5e856a1d7cec7baefdaab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615988, "uuid": "5bcb696b-d947-4324-8f6d-94f5259fd253", "comment": "Malware payload (PureLogsStealer)", "value": "8b7f62cc1fc3aa18ed6bafd82da5748d91564dad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615988, "uuid": "ab61a745-ee85-4094-b6d1-5f6f2051573b", "comment": "Malware payload (PureLogsStealer)", "value": "c5d625c9ccf16f2498243a9055dfa52fa794c390122c4ba3508d23f3fed2995e833290e531677ab21fde38e02ee43dbc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615988, "uuid": "fa48bcc6-e44f-48f5-ad66-82a617ab04a7", "value": "T14605D93CC994412DF572A618C869045FF8933A4B563CD90B60CA2B4F6FB3986B7D236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615988, "uuid": "8f614c87-bd4e-4657-ba2a-b5c59c4790bb", "value": "3072:+q1P1hIRSGpfeTgs9MlFHM0DzenaJrwtc2c7aR3mNDb195n14Ia0YQ7hFMH8399d:LhrGpCg+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781615988, "uuid": "290f2c94-2b96-49a8-a2c0-38295e28ab01", "value": 832932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781615988, "uuid": "005d503f-237d-4f41-a1f2-ce17bbe8f0f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615988, "uuid": "08aa8ca6-450e-400e-8b91-a1eef95a718d", "value": "output_643d2gzs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aad4258-697c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781611770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611770, "uuid": "44c16c78-3ed9-484b-b74d-a0d6d8f83b8d", "comment": "Malware payload", "value": "0ca9824a77c4e2037be29dcacefde6e0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611770, "uuid": "0896fd88-f693-491a-b525-fa1029ae3834", "comment": "Malware payload", "value": "4591d637db0c54a7081d4bc44d88fdd7d4a7914122a82a9f452e05b2f09bec18", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611770, "uuid": "fa966bc1-701a-4e56-8604-68e0e40e5a34", "comment": "Malware payload", "value": "924f5fe247753c908671bea9597b120220f0f82c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611770, "uuid": "00547c49-1a27-4a5f-a854-c98a162a7732", "comment": "Malware payload", "value": "ec3437c2b5041ac70a0295592b318c016495223fdbbb8ba03fa703ea54464673954035070317c18d598af1899fa5fa14", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611770, "uuid": "4d3c63a9-134c-43c1-ab77-3d5b0d518bdd", "value": "T1A5B43D12FFA32E22C0DA8A79C1A5C3399B679C96DEA1535770CD3E2BBF344540D1BA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611770, "uuid": "a6bcb794-cd17-4e4c-bdd0-cb5068c898aa", "value": "3072:TWnUXmo5TNL1zJEkW53wo9QTFaYB7BgCqYchFkuaJark3OExZ:TWwTNL1zeCdQK2rah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611770, "uuid": "1e596e0c-7276-4a95-b388-09090e1dcbb8", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611770, "uuid": "ff4d070b-ad63-46d6-b125-95a2a27ed3a5", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611770, "uuid": "c6802fdf-0156-4928-a4ab-42b089932fdb", "value": "Registro 8C.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5789101-696f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781606420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606420, "uuid": "79757925-19b2-4d43-a4c4-107a300f04dd", "comment": "Malware payload", "value": "ba8c25d6ec49d97393cdca3fb65ddc68", "object_relation": "md5", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606420, "uuid": "d6d14445-0034-4fa9-a6ca-e051faf09594", "comment": "Malware payload", "value": "47544197e7a990f287e2672ffd477a6d1db54646b5170677105555b42923fafd", "object_relation": "sha256", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606420, "uuid": "4724a62e-612e-442e-8ff9-c2492006c6a6", "comment": "Malware payload", "value": "0f99cde9a8abd3283f16883b861615f021fafedc", "object_relation": "sha1", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606420, "uuid": "7425e94a-d423-4622-8871-6355e7d41df9", "comment": "Malware payload", "value": "f0dbdbda281ed206179bd828b2957cbb71c1ae48425ef5420378b13f6cb287a8e5046a05ca9e7e80177f57c0d7a41618", "object_relation": "sha3-384", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606420, "uuid": "5e1bdaa8-4db7-4ac9-b877-26b2d91883ca", "value": "T1E556C013B299253EE87B1A36483F9754983B7EA126924C0797F42A4CCF7E5401D3AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606420, "uuid": "5b5f1a28-9082-48ab-94f9-e5e820dd584f", "value": "ebf9f50934ebfc138912ce0c5847005a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606420, "uuid": "ed1d5235-0380-4b03-b36c-b8516041e2c4", "value": "98304:lIS6/e7gju6UY3Q0YPEgRHTsm+MCvkBpeq/j:uSwUY3Q0YPppsm+MCMfek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606420, "uuid": "6fe2f1ce-e63a-4c29-ba68-4b60e4a93f67", "value": 6083043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606420, "uuid": "d4b6bc6e-a5d6-4cac-8df2-bc9abd3873b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606420, "uuid": "0ddd2d2c-83cf-4446-9310-8ba7661f3d04", "value": "47544197e7a990f287e2672ffd477a6d1db54646b5170677105555b42923fafd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712e77d1-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625605, "uuid": "9271142e-3311-468a-86c1-f251daf29529", "comment": "Malware payload (Mirai)", "value": "b7d20e5f364d39ec85372dbe0718ed2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625605, "uuid": "f26b7476-5ec3-4f47-bc58-b4a710ba4534", "comment": "Malware payload (Mirai)", "value": "487a1d887710fd9eeb08359a909cd930d04719a637538edfc227602812b1ffd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625605, "uuid": "6724a9f2-f9d0-4e50-9d8e-2b12b5c56726", "comment": "Malware payload (Mirai)", "value": "3b9a43e0be454922c008f2ffaff35deaae535cac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625605, "uuid": "363458d3-b714-4142-9441-909659c684ee", "comment": "Malware payload (Mirai)", "value": "4c77cc984f0febb39d7961c4cca55bff65fe3b685dda838b3aa58b6b99e96376ec558db02fd9fd656daa2b78e40887ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625605, "uuid": "c4a8eaf3-dff2-42fa-a197-c79e914859ce", "value": "T170437119BF640EB7EC6BDD3749E9171524CD641A21A83B3A7934D818F24B21B19F3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625605, "uuid": "79aabf79-c4fd-48dc-83d2-ca1f10de9443", "value": "768:tAmF5TKjlkBJLk6rH6wadQ/254e/5XCeJe1iefChN4myQS9xYT5hrXiTGAppa+B+:tAmF5TKjlUJlBHwUgwiGC11T+B5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625605, "uuid": "4bc4a996-c938-43c4-a936-2e6bec53b5fd", "value": 59384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625605, "uuid": "635703d5-b5a5-46d9-80df-61890ab5b77f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625605, "uuid": "56cd4cc2-f0f6-4932-96a2-28e23d5798eb", "value": "ca382f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d4b296-6968-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1781603092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603092, "uuid": "c3284301-7d84-4005-b10d-e7f83df670ab", "comment": "Malware payload (Grandoreiro)", "value": "93f1fcbee6b0a2ea4a58ced4b8bf161e", "object_relation": "md5", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603092, "uuid": "ba63407a-a107-4b0e-a22f-4f035e8b2775", "comment": "Malware payload (Grandoreiro)", "value": "4888755f23a77d2f38052b637cf950ed8467a332e6568cfb276908ad3b89a3a6", "object_relation": "sha256", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603092, "uuid": "8fbb3b70-8ad8-481f-9738-5fcba5f6fe6f", "comment": "Malware payload (Grandoreiro)", "value": "53f519e1e19c54ba4ca955ecd06690024ba85e3b", "object_relation": "sha1", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603092, "uuid": "5c593bdf-2ae0-43ef-bc16-789a0f02148a", "comment": "Malware payload (Grandoreiro)", "value": "5123ce05739f1fef826beeaa31b31b86402fa806521d8e307aba634ee03a37b11dc1181c4fccd8eeedf84709660c77e6", "object_relation": "sha3-384", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603092, "uuid": "df280803-e71e-4b06-82ea-3d50a1d6af52", "value": "T118515B6B006A4918ED878D361C036866E44BCDAF810CA9DBF30CFAEA9A04217828C285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603092, "uuid": "2d5960dd-7b96-43d5-9e97-047b1b90544c", "value": "48:9DynKHZv1uuZa38Zd7wyTK8mEejlwg5BvlY+/tR15OQwwmh0cRyB:5phsPekjig5Bvl3tR1zkhnRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603092, "uuid": "0a950d01-fb82-4c7b-a596-f5ac7dc45717", "value": 2784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603092, "uuid": "87eca3e7-0ade-497c-b052-f7fbd7df72fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603092, "uuid": "e953b29a-1954-446d-ab4b-e8b971fff2b5", "value": "Doc-0910019.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2261e848-69c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781643083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781643083, "uuid": "ad9f5f5b-1a48-42dd-83c1-34a01f247d7f", "comment": "Malware payload (Mirai)", "value": "bb236302681e68f0c03663b8a78cc824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781643083, "uuid": "0af0a3dd-60ed-4e70-bbe3-bf380aa34c94", "comment": "Malware payload (Mirai)", "value": "489fe5af39afb3d4fee34fedfa41f3b169f5192380e867a060de7baa18a7d44b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781643083, "uuid": "527c513d-c1d4-495e-a199-52a7bf29731d", "comment": "Malware payload (Mirai)", "value": "be019dcd4fd7e7b6ef88c6471b9e60d226228d83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781643083, "uuid": "07ac7e16-9614-48be-8187-6a1d0a2a41a9", "comment": "Malware payload (Mirai)", "value": "97181ddd4a0e1089f2763861c0b0c200cb62c30ddd4daafde9c47af2551fcbd1311a8bb82c91b9ffd4c9391de78bde18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781643083, "uuid": "31164050-2e21-4405-97a4-44a91679dec1", "value": "T1FD93E64AB9419B01D59731FAFB8F425933536FACE3F97101DA246F6423CAADB0F62112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781643083, "uuid": "25f60072-c2d5-459c-9bef-af96b35966db", "value": "1536:73nw5q9z7CYLtSjMhlwY709ay2SrOQB6WxNIlKQBQiEp76zYwgoZJwr7+rs:8I9z9ZC4aY709ay2SrOQBUqp76zjJw2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781643083, "uuid": "59cad81b-5124-44f7-98bc-df02b973e869", "value": 96504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781643083, "uuid": "dbc46478-6a8b-4a01-8a24-154e905d6bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781643083, "uuid": "d30d5ea9-3924-40d3-a2b5-e0612157d62b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13578160-696e-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1781605691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605691, "uuid": "be7e9d38-b70f-4e89-8497-94f5d56195fb", "comment": "Malware payload (Grandoreiro)", "value": "f2caac1ca2a2d9dfc6c8dc5dbaddb35e", "object_relation": "md5", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605691, "uuid": "d50d53ff-f870-4db9-ac32-c8553bfb84f7", "comment": "Malware payload (Grandoreiro)", "value": "4a5f5861e0c1b4c39d090afe16d25079e29967a6d7298ffea9dcd0370af42d05", "object_relation": "sha256", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605691, "uuid": "cf09230c-4fd4-4fcd-bd06-eac3222774e3", "comment": "Malware payload (Grandoreiro)", "value": "dd9dff4f227811f71e48294321cd2df1f5d6cc92", "object_relation": "sha1", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605691, "uuid": "a9da642f-5450-4153-b46f-b6c189eb89a0", "comment": "Malware payload (Grandoreiro)", "value": "9460d0ef773932af892a4826f7fa9e9f589d93445392a1a02fd7d76c9aa8b3a4716af8bf8b73d9acf0bb6a92b68286a1", "object_relation": "sha3-384", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605691, "uuid": "894554ee-f347-4f5a-a544-da7105f1df5e", "value": "T12AB5336552AC3B78D0A938B42646E2FCE1F32DD6264E8E8A424D97F43AD4BF7450C05F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605691, "uuid": "5e4e605c-93a8-40f9-ae0e-76fbca8f94c5", "value": "49152:NYePSK3hn8Q8E7/V53RZ+sDhygo9+ZHKccrP+w2XusZYo3u61bN/R9go9pOhlIu:NBhEK953R0stJo9i5pZYo3jN5ao90hld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605691, "uuid": "df4d59fb-a1f7-405f-bea9-d95247ed7860", "value": 2429594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605691, "uuid": "945d9af5-c276-43da-a802-59dbefcbc03b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605691, "uuid": "19fbb7ff-d1ef-4f79-a0ee-f0ea5d4b7952", "value": "RMMClient.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856a00f5-6985-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1781615761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615761, "uuid": "9bbe9b0b-0670-44b1-b276-7722627fa9e0", "comment": "Malware payload (VioletWorm)", "value": "806e54bd980e0465d92db5b11f81021c", "object_relation": "md5", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615761, "uuid": "f65f4589-f95a-44af-8c79-ec00ae8cff37", "comment": "Malware payload (VioletWorm)", "value": "4a8599ac36825b0a6433ab5b8088f51569808740332a4c140196a3f4e84fca12", "object_relation": "sha256", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615761, "uuid": "a64d09a9-e7b7-47d2-943c-d60c547857d8", "comment": "Malware payload (VioletWorm)", "value": "8da24a60d02002707b2f547a7cfaf56057a3bf05", "object_relation": "sha1", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615761, "uuid": "bec1349a-aea8-46a5-8888-4385b2362ad1", "comment": "Malware payload (VioletWorm)", "value": "42042c8464c78822ccaaf4e6c2e3a5f2cdf5725a9765bb512fff4367f7369105b281b48edda87947bdd21999feab121a", "object_relation": "sha3-384", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615761, "uuid": "f1816abb-39b5-47dd-81b8-501856c7c721", "value": "T11163E98836B7A437C07FADB6E6C7224B2EB060737801E5551CD136E26A12D85ED4ECF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615761, "uuid": "10304525-d77b-422b-8b53-868e3ae8a9d9", "value": "1536:088h1K3Ga5ybs9b9bTrI4Vwu/FcVs5nL:AmGK8s9b9bXuu/FcVs5nL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781615761, "uuid": "3e6d6254-5f85-496d-b0da-623fa1f6b323", "value": 68858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781615761, "uuid": "0947b60c-9a97-47cb-9e87-fd3b66124ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615761, "uuid": "49453bb1-fa01-4463-b16d-273b8528bb8b", "value": "17816014850c94e3c7e85452c336031dc96030ebd8c877446b35f20de93b5488e66e19ec33199.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2fe064-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607719, "uuid": "24705107-e198-4718-b8c9-2f061ead6c04", "comment": "Malware payload (SilentNet)", "value": "9ee70af11f312660169893ec537b576a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607719, "uuid": "a9ae731a-7903-40c2-aa92-053009621df1", "comment": "Malware payload (SilentNet)", "value": "4b34d92bf3e771d285fec73d54fc7df0e613c09ec6f29299a34e71f112845e6a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607719, "uuid": "005faabc-8c43-407b-acf5-6b7afc7a017f", "comment": "Malware payload (SilentNet)", "value": "64d715e3db660aa87d4ca640e7fe5746b47e7efb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607719, "uuid": "85ca7d3e-990e-4eac-b2c2-e2c34e9314c2", "comment": "Malware payload (SilentNet)", "value": "e089ba7fc3f3c2c2a15804c777dd15eee53856d2d3427c46a64e4ddabf0ec0e5802e23db0e59fcf948bad0503748d609", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607719, "uuid": "a12a9c6a-02de-4ad8-ae96-2c0169abd065", "value": "T1D1250203BE6D8825D33B503EE58499533CAD26DDD109E13385AC4D9B2CBB9D80A89FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607719, "uuid": "b8420a63-8a7d-491e-8e4c-f30a6350582f", "value": "12288:XqYR4KDdgaRQSFV25FMSKk5QFcdOH2djlIzwh6ebA8ZbpIwogOSypiHjFestFrRF:XDgaCx7/5JU0h6ARYZDpiHj8u2jpy6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607719, "uuid": "5b6405fc-84b4-457f-9b36-ad249b38bc7c", "value": 968152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607719, "uuid": "0bcddf9f-4ef1-4f17-941d-b4fb757c6655", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607719, "uuid": "8119522a-a729-4826-8c6d-63aa7ca88ca8", "value": "4E-Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51d71da-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607788, "uuid": "81a5d446-cb69-48da-9c3b-d30ff6542290", "comment": "Malware payload (SilentNet)", "value": "87becc03551c2534009305b27ec333a3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607788, "uuid": "9bc0603f-0eb6-452f-89b0-e5c1e5e21fb0", "comment": "Malware payload (SilentNet)", "value": "4b87b64336cc4a3d89a68aaff9b04c63bc5dec8490047c14dc01ba7c780e0e9d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607788, "uuid": "7fc93cab-245c-489b-8ed8-8fd94d53b6a0", "comment": "Malware payload (SilentNet)", "value": "c72be662bbf6b87f03ed57e6b1e3af28411dff61", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607788, "uuid": "c2ef03d5-8187-4b11-ac01-2c52b9e08c57", "comment": "Malware payload (SilentNet)", "value": "fdbc2caa9cd9de03b80170e3709c91810dbc81fd7cdae0075a255ebf1e178959e18ec0153ff97945a1ca09312530a79b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607788, "uuid": "f67d863f-51a0-4f1a-b84a-ec66dc51e0a9", "value": "T18D56224EFEB49299C517C03FD1029BA2BE1C42C8A185B01F25F8556A18EBF4B471EBDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607788, "uuid": "a3e7d998-5cf7-45fc-98be-53f470219e04", "value": "196608:X9U8lV2nWka7t4iApCVl9O8CD2MMw/eTFUNvXNU:X68lV2nWV7t4XCVl9OrKMM9qNvXNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607788, "uuid": "95f8c22e-7a85-4e93-88fd-42246faee19b", "value": 6459178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607788, "uuid": "043d28db-4bbd-4ba3-ada4-f5f650feb99f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607788, "uuid": "f37cd0ad-ec50-486c-b254-4fc3e5c32a73", "value": "ThunderHack-1.20.4-1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b06777-6977-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781609691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609691, "uuid": "d2328c16-ca52-4c97-bd31-7bdbae779bbd", "comment": "Malware payload (Vidar)", "value": "4f5295be962f9c1cd9e0537eba76c863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609691, "uuid": "0054dbda-ae5f-4472-98c9-83d5feb8ffca", "comment": "Malware payload (Vidar)", "value": "4bc82ebc691ce659b591db26ce756df0bd2da2959a0f84c2deba108f12660993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609691, "uuid": "8dedb656-ae00-445f-a9f5-7fb97ef435b0", "comment": "Malware payload (Vidar)", "value": "781936dd2ef090336d7803d53e5bc23b021952cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609691, "uuid": "23cef999-7ba5-43ad-b369-5c1aa23808be", "comment": "Malware payload (Vidar)", "value": "7c45360823bcf894a8c0ee499c4bfd70698826d04d7a6690c1ce7e83816f0fa1301f3caa2139f8bb9e669c8f662465ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609691, "uuid": "619c39be-7f9a-486b-9d26-2b4d5b81d71b", "value": "T15D068C03FCA05CB2D066A23289F746127B3DBC4A576223C76E50B77A2E77BD0A934355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609691, "uuid": "c6c05c7d-7e2b-40a4-85b9-564858996fb0", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609691, "uuid": "73d58ddc-23a4-4014-b749-39abc1c6942a", "value": "49152:9XFrP1nvRF/VYQt987YuhjB0RZD36HsR3c2ye1cEflozwxt28WqTzt8iOOabl8G0:9dp9YQ07uhMle1fd1n28WqzgunJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609691, "uuid": "95c9c85c-c1b5-4cd9-9b1d-d8b741fd41b9", "value": 3778320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609691, "uuid": "c27c29d1-00f2-4bc1-9c05-af4558811656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609691, "uuid": "a0a8a3b2-69f6-4533-8b5d-7b9d122e1acf", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a8df79-6977-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781609614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609614, "uuid": "0740de2e-5233-41d5-8b44-400a5cf232f3", "comment": "Malware payload (RemusStealer)", "value": "d68499e4698ec63820ba5b745df2c841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609614, "uuid": "3cf3142b-22f4-4341-b9f4-7315d0b89895", "comment": "Malware payload (RemusStealer)", "value": "4c5b729c3522fdd11dfd3e5807c225df109172981d2c214b2a905fa2bf6b39e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609614, "uuid": "4dd5a629-eac3-4179-8933-ec82b1b920a9", "comment": "Malware payload (RemusStealer)", "value": "08f213fdcc86f243bd893432b32df9d6b0830cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609614, "uuid": "124dbcd9-571d-4e5d-b059-61340505600d", "comment": "Malware payload (RemusStealer)", "value": "fd5f323fca086ddf6f764f2b2e808ea376e40fb25805425745628319b3fae248d029c6fbddae2335bee25bab589a02c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609614, "uuid": "e401bcbf-782f-447a-8041-eef85643f622", "value": "T19ED55B17EC9148B6C199A33188B786527B3CBC481B7263D72ED0767A2E77BD0AD39314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609614, "uuid": "a3649cc6-672b-4928-a974-a5fc9384e3fb", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609614, "uuid": "c4226a84-4a8b-4770-ac4c-ffebad42b0ba", "value": "49152:ue+SQ6b+5okZYTLxI7uPFNDsl0OtDhHIv9:uljZWxIWuDlav9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609614, "uuid": "297d7397-6daa-497e-bb23-c02ff2d3070e", "value": 2951584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609614, "uuid": "1c14f341-0c71-4024-82b3-14fd8c740c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609614, "uuid": "5ca70fcf-0a8d-4939-b481-d52317432665", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba44d14d-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608548, "uuid": "ab9c8763-ab50-4474-876a-3659e3a34988", "comment": "Malware payload (Mirai)", "value": "780929c7dbfc70da471660c5ed7b15a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608548, "uuid": "f73577ab-7152-43ce-9e1b-caef056c505f", "comment": "Malware payload (Mirai)", "value": "4d2c6009c34c0df3015d6bad085fb7ca706f83f3183ede59aeb3fdfabd57675c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608548, "uuid": "840d2ed2-d425-4a8f-b941-5db43dd9862b", "comment": "Malware payload (Mirai)", "value": "9107c06308056a41b26bf8b913dfb07087b6781f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608548, "uuid": "e4aa0455-5834-464d-8e2c-5bc22e22338d", "comment": "Malware payload (Mirai)", "value": "4cb15e624b014c51c538de6b37cc1a21bf3d419811f1207fe1093d8f649d8fee74ad374fb786b8afc7db18eb2dfa352d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608548, "uuid": "ac536391-4de9-411d-af31-4c936b7e871a", "value": "T1BB749633A9158495D0108CF322A773559C079BBF88B622D3EB566EA4FF3441B52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608548, "uuid": "6cba59ad-9ecf-41ea-aeb6-245504548d08", "value": "6144:2jAsWdIMT5rgVgD4BhbiOWmEFB8MW2GkkQNU:bTQgDQihmEFB8MW2GkkQNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608548, "uuid": "40579fb8-94b8-405b-b6c9-94a431a87c1e", "value": 350967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608548, "uuid": "f06b3a1f-899c-440e-a993-05633265bbe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608548, "uuid": "8dd9a27a-d42b-4a9b-a873-4a14edddbca5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d31a69-6954-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781594557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594557, "uuid": "5daec963-4d7b-4505-9e88-6e1365090dd0", "comment": "Malware payload (Mirai)", "value": "4198f3b143d82ac929a72dad2a7471be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594557, "uuid": "2b62d510-56d4-4424-95a9-0472ae51c8e5", "comment": "Malware payload (Mirai)", "value": "4d8d8535cf0ccc345abb59c4529cb342a8cbb7171ae005eef10b117c68884c96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594557, "uuid": "142b3371-38b7-49cc-95a7-05a698b5bcf1", "comment": "Malware payload (Mirai)", "value": "fcf400d83e35dfc9d63ec1f0fccd67cc8df47c51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594557, "uuid": "1900a601-5e3d-4cc5-a7a9-b81486cd6749", "comment": "Malware payload (Mirai)", "value": "3867aba1851701570df7a56e999e0c670247ec432fe8ecba8a176d271e123bc9a9b62ddea9f128e1e1f72f4499719671", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594557, "uuid": "64c8f955-40cd-4f82-b523-08bc7c1824e5", "value": "T1E246E05CF213688EC0FE787BB3A5CB4409829F4774E69EC23A21253E657C6324F56B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594557, "uuid": "2b803122-5da6-460f-9b45-a51cc7d445b2", "value": "98304:d/APLcleI3j11smewUW/B5OnZgsrC/tS7d/zigyzJ6:d/APuhjkdWmgD/tSZ/zigy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781594557, "uuid": "8d7f6264-8331-4230-8a7e-d8b64944bf3b", "value": 5688432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781594557, "uuid": "21807e41-53c1-4e68-bb6f-c0061d621382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594557, "uuid": "af88f0e3-4d68-4b87-a57e-ad4738cf01d5", "value": "xmrig-armv7-static", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d99cb4e-698c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781618674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618674, "uuid": "bdfaedb5-5b23-4888-9a50-bf1b97045b7e", "comment": "Malware payload (RemcosRAT)", "value": "fb483c847d69f1566737e251467ed244", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618674, "uuid": "486f2369-1af1-439c-84fc-5e82e06a1e24", "comment": "Malware payload (RemcosRAT)", "value": "4e03498bc61d2b713c0669b58c45dbfd2bc6091ce3db935c5df104a9bb6e3f93", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618674, "uuid": "5d6a0e9a-14d5-4e8c-a9cd-dda6d31b6123", "comment": "Malware payload (RemcosRAT)", "value": "f168c0e561b2a7d719984629c5bf4cd45bec40d3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618674, "uuid": "f4466c44-586f-4166-b9df-c4a0148331a3", "comment": "Malware payload (RemcosRAT)", "value": "c7bf364bb43e06bc0d1bec1af10db2a978a4632386efcc3ccfa7dc2446b2c8f3396c10195b3aa204fb257a9e8830e8ac", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618674, "uuid": "d12f997f-0c11-4c96-8ee0-b408a10d102e", "value": "T1CED2A8DADA409D9FAD13EAD61B543AD0CD35E108149783383BA562DBB3A701D934AF3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618674, "uuid": "901f2f10-a539-4334-a535-618c2373b5df", "value": "768:BSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxSxv:WTyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781618674, "uuid": "7a469236-c273-42e8-8034-5921f18dfb81", "value": 29985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781618674, "uuid": "51ad4cbe-2e1c-431b-80ff-367fb6b2f3cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618674, "uuid": "fa8ededb-73a9-4cf9-be45-25223d7ab432", "value": "greatthingsfromthebestfeeelingscomingthrough.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d504aa-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625538, "uuid": "62000883-b531-4928-b5cb-2580eb69db5b", "comment": "Malware payload (Mirai)", "value": "89e2c08184ef47a20501cf0f05b10e37", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625538, "uuid": "5afd9188-7a82-47a4-9947-710338c48eae", "comment": "Malware payload (Mirai)", "value": "4ed61165beb338d3c8dbb0f71b328ac71d382ac3dad6a1145aaf16bfeb894010", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625538, "uuid": "d2b4d468-6cad-46dd-8184-c7ae68e0c81a", "comment": "Malware payload (Mirai)", "value": "1fa6de99c20f3136b43443321e69c4791c5fe98d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625538, "uuid": "0498185a-fc4b-476e-b921-f746a01cac09", "comment": "Malware payload (Mirai)", "value": "da922359f1e372bcf9ea19f7ab141dd756c9dd0ceaaa3c29b7e36e71843793b7f36adcd6444b3316765d2ad16f114df4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625538, "uuid": "4db52d58-28b5-45fb-85f5-cab5954c75af", "value": "T159314FDF45146A391B02CADE73723048B10C42EB185FE3D48C595FAD868899DB293FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625538, "uuid": "2414d773-8192-4316-bcd0-98bf72f10543", "value": "24:xPtMj3EzEuyFkzMMIbfQ4DzlGIevqwTbI:xPtMj3EzEIgMIbfTDzloCw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625538, "uuid": "e879331d-7b8e-47a9-85f0-07685a5b25ee", "value": 1644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625538, "uuid": "7e9ef03e-0ec8-428e-9300-748ff2c9347d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625538, "uuid": "88d77c39-0c7a-4e50-8a8f-79c8f38e2bd0", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad4c5a0-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608657, "uuid": "06a85c00-a1e4-4d87-8e52-fe2d7996cd97", "comment": "Malware payload (Mirai)", "value": "79fbbef2b926f9881fc3529abc6a034f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608657, "uuid": "7e66ddd8-f9e4-4f6c-b593-90bab7fbf96b", "comment": "Malware payload (Mirai)", "value": "4f4db7b029379e1e4fd4157c08f4cc2de6a682a38849ec10666450571067f074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608657, "uuid": "a7937735-ed73-4507-a64b-89c00e45678c", "comment": "Malware payload (Mirai)", "value": "8996b0bc32b2420d21e050a0d453533260fd1729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608657, "uuid": "6648cfa9-3803-48d6-97ad-a10a893ee4ce", "comment": "Malware payload (Mirai)", "value": "f46c9125d16efa779e54b332c9c4ab0f0e260a52ddc48f944b597ff8f64347f36d7353b37e5a0e351a9c920f45c27c9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608657, "uuid": "37fc18f0-e780-43ca-a732-932229dba1a1", "value": "T122647233991584A1E0204CB3226777469C47D7BF88E726D3EE5A59B0FF3441B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608657, "uuid": "0d8ef409-4ae3-48d7-bada-dffcfc87ca9f", "value": "3072:Rbas6/LJOU+CF0l+hzUnR/WCxlKwjoSiSaNnHmXFvtMdxDaJaT:RbaS7CC4ahxQwjoNdBmXFvtMdxDaJaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608657, "uuid": "56f25cab-a210-4583-b959-671f844398a6", "value": 323819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608657, "uuid": "2b21d9af-d1a5-4b76-998b-504d23a8dee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608657, "uuid": "67911c9e-bf82-4783-8bbb-af53b055bc14", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b63dbae-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781607530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607530, "uuid": "7b8e712f-e670-40a6-a69d-6b42907af8b1", "comment": "Malware payload (Kimsuky)", "value": "fc66e046447092c606f2587837f96874", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607530, "uuid": "8dd5e9dc-e8f4-461e-aa0b-c19a19f0763e", "comment": "Malware payload (Kimsuky)", "value": "5069425b121346b36f730910d05402d50920fc2178b01e0c878b71af4ef1eb96", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607530, "uuid": "8f647c99-0b87-4031-be90-d79ca6ae8203", "comment": "Malware payload (Kimsuky)", "value": "fcf354a8044f494ee1f9fe868dde3f570f50e593", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607530, "uuid": "fc931412-4032-4889-8a7f-beb33977f40b", "comment": "Malware payload (Kimsuky)", "value": "9342aec4aa08509fe49a5cd4d7735b92f6c844384fb128e11b97f7f14e2caaa82a28646c4b339adeacdfa994b03fd9db", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607530, "uuid": "93052240-3128-48da-bcf7-f63fc95d456d", "value": "T1355200C203894A7CF2C92ED68C2F605620F3E54A3D251249EFB399DBBC77D895075A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607530, "uuid": "9bc15c38-61be-4875-9564-afe68ccb5b08", "value": "192:4hsoEj776Bn/tnHcgaollys/6+EgH3JLg7oLu0MyMVu:i50/3xoGs/jE839g2FB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607530, "uuid": "62a5c62c-0325-4534-b6df-c933bba3846a", "value": 13733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607530, "uuid": "551e0405-14ce-4b59-b360-22311af1bad7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607530, "uuid": "3745b79c-a898-46ce-9f0a-c4ba7538784e", "value": "uni.site_1.je.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab5fd2f-6997-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623689, "uuid": "569a93bb-d9c7-4e3d-9dee-e4647b618eeb", "comment": "Malware payload (Mirai)", "value": "be9898945fd2cf727563d0b50c6d344d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623689, "uuid": "fe5a17b2-3d7f-437e-a797-8e9612e4caae", "comment": "Malware payload (Mirai)", "value": "509ba7a7b14c31d66aef55401ac8d1a3fdb5c71e61fae5b440dd63098725c7ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623689, "uuid": "9b2fd57a-4b80-46d4-90f8-c4043352356b", "comment": "Malware payload (Mirai)", "value": "81d17fe4dd7f98d69ed475708a5f1f08489f2516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623689, "uuid": "82af7287-c4a2-44a2-9fc1-14ca00736714", "comment": "Malware payload (Mirai)", "value": "4a31acfc44bf52757ef5e5ab4527dc7dbb910796e6fe262d27846ba478a8a297789def1a444ef1f22dcde530287dda97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623689, "uuid": "f18bc789-6bf0-4bf3-84ce-8fd91f1fdb42", "value": "T1AC44F70ABF610FFBE8AFCD3342E91B0125CC541622A87B7A7574E918F54A64F46E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623689, "uuid": "21a83d0e-376f-4171-b0e0-b6b50d2cb985", "value": "3072:1HFzZwYNm5XmWxGLMIG54rO4WnpJIcYursAX+wnCs+9zjLH58:dZ9NmRxxkMErOjucXrl/X+97HK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623689, "uuid": "6101c470-41fe-4b87-bcca-918adae594e8", "value": 278640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623689, "uuid": "422e389f-cb11-4f8c-9dc8-2289ced0ddf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623689, "uuid": "26810540-9955-48b5-8769-e43858b724ec", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78e9ecf-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621858, "uuid": "1dd311f7-2edf-4900-97c1-52dc5ad295d4", "comment": "Malware payload (Mirai)", "value": "224077395ec24bf1b575dea17da63ac2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621858, "uuid": "02c992ca-9ac3-4960-ba1d-63976d31ba6b", "comment": "Malware payload (Mirai)", "value": "5156fd3014ba001a09c61a74ea4daa8e87782a8d07340f5896c2b797ff9aedc2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621858, "uuid": "6df8d39b-78d5-4d0f-a0dc-43f642ac05c7", "comment": "Malware payload (Mirai)", "value": "d0e889e7f011fb1922aec3322c1a9477142f9cbb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621858, "uuid": "1efe652e-a666-414e-bc07-c37350dea445", "comment": "Malware payload (Mirai)", "value": "0abb03c59ca614971ba884cbc609b563f65b8e19afa6fa12d7b159cee72cbf3729324bc429b005ccb3c0655411b8386b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621858, "uuid": "14364b3d-69b0-44b0-8c8b-16417ec40fe0", "value": "T136B3F845F8509B17C6C612BBFB4E428D7B2A076CD3EE32039D256F25379B99A0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621858, "uuid": "501ddc8e-7bd5-4206-b464-287f9afc6f94", "value": "1536:PZV5GarEzcT38EAc+84V/1fKTSv2DfYsOcdonPutylO3wyw4YQtT4NmGsGtQCvVQ:PEWCcD8EV4LCOvAZW2huhtJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621858, "uuid": "f6fc3299-466d-404c-a421-23ba37e853e6", "value": 117536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621858, "uuid": "0a47c889-e675-4902-80db-2fd4ca7861c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621858, "uuid": "2848756f-4dc7-4901-a8e1-fb608941e625", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6796f23-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608649, "uuid": "8ee65c74-7bc1-4447-b43c-62aa81984475", "comment": "Malware payload (Mirai)", "value": "e9b882723e4b529667031edc13a74d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608649, "uuid": "ed2045e1-c7e5-4a23-97ba-a0b7e556b95f", "comment": "Malware payload (Mirai)", "value": "52af5b56c8d65135c05175c451a84db413664d4aa73d64c93cc8178cf5342753", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608649, "uuid": "374c2c69-ce8e-4484-9be4-088de3ee879d", "comment": "Malware payload (Mirai)", "value": "618c3fc6b6811b956536e259ea32eea30424ecb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608649, "uuid": "5291bbe3-f61d-41c2-9313-76334ad38a35", "comment": "Malware payload (Mirai)", "value": "349ab7e439d11f772998248b926440d00cbbaa53f45227f99b903481f00166f026fe57bed74ed6b735ce0390b112dc41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608649, "uuid": "8f2f7cb5-a0a9-4120-91af-6d632ce94ebd", "value": "T195648433991584A1E0214CB2122777569C47C7BF88E726E3EE5A5DB0FF3141B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608649, "uuid": "106504d1-ab2f-48a6-8fca-b94aa6bd41bd", "value": "3072:ZI/WgC23UPqclZz/Pj3Xo0bZ++KwjoSYCtxtlPW:ZI/RaqaZTjBolwjoTCvPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608649, "uuid": "5623e101-f4ed-4e06-8a9e-b706d5c9d5e6", "value": 330057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608649, "uuid": "20d26110-297e-47c6-96d2-43ee2b1e4070", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608649, "uuid": "024ee5ad-fe8d-439c-a004-56d7b76de4e1", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2795623-69d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781649847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649847, "uuid": "47f0abf7-18a8-4f17-8bbb-7c25d59f038b", "comment": "Malware payload (Mirai)", "value": "4275adb179f07069a94f966f3954eaba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649847, "uuid": "fd04f9e6-ec76-4dc4-a9a9-a84f9014777f", "comment": "Malware payload (Mirai)", "value": "53b51fe1ba08aff1bd4127848dbde183440d07a486e587ef9a1b771e9d133df6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649847, "uuid": "a66732d7-89f4-450f-81f2-ee67edf2a277", "comment": "Malware payload (Mirai)", "value": "092bbafd58c1a01b4e89a9d92cf430ca6e0809ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649847, "uuid": "3e175208-3ffc-4979-b836-40465fac366c", "comment": "Malware payload (Mirai)", "value": "69daf8f10a9998c984016ca8d3dc72f24d803c59b782b51a6c14e79f428cdba3779eaa275480afe07d5e23b08466da39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649847, "uuid": "e0d6235f-7a4c-4c70-a8cb-745d316e1d84", "value": "T1A5933894BC419B12C6C6227BFB6E428E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649847, "uuid": "ed17ef7c-ad0f-47fa-bbbb-43be9d221f23", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2DM:eyxt7W+G+3QBBntmzg6d7WidDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781649847, "uuid": "670c29b6-8792-4a3e-bae9-65fd6c5301db", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781649847, "uuid": "99a46c3d-3969-4279-9651-436a3694107c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649847, "uuid": "6ce066a1-2c66-407d-8d24-4b8a03f9adc6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944d8476-69c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781641556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641556, "uuid": "eda37bf4-8dbc-40ac-b2b2-a461ef5e9762", "comment": "Malware payload (Mirai)", "value": "63bdfee62fa61945c6feec5e649fdb74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641556, "uuid": "174b0168-7cf4-47eb-af69-b128ba1f9b4e", "comment": "Malware payload (Mirai)", "value": "53b7b12610fee10b40ca743730d40fe427b38aeb43b7abc82f1e71a7a84cbadc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641556, "uuid": "411dba8e-647b-48e6-ba81-11167f884d2f", "comment": "Malware payload (Mirai)", "value": "10bab6b7c24e5c50fb80fc8391c9e0dc5ec5629f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641556, "uuid": "a07be6ac-9447-4666-8435-98233a22c13e", "comment": "Malware payload (Mirai)", "value": "52b0b77a0271911238a5d8e47708f3a4797c8419697b1bc6752961468cb4678e04437d2276a71ecbebc3c02a5d1b9802", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641556, "uuid": "2ced8993-7371-4166-a2e2-5c5c06ff8d41", "value": "T102242A46B8819F15D6D026BEFD1D128E332717B8E2DE7206DD245F647B8A86F0E3B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641556, "uuid": "1e011b6e-59c1-4619-ab8b-795c62060e0b", "value": "3072:DX1kKm1lxc18IAWdB9YI+y3r/UqC3EwXR7nMJaXOn6S/yZlfgSktOZl0C:DXal1l+lAJGTtnwX5nUaTfZlZktOZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781641556, "uuid": "d89abdb0-8550-4f4f-b548-2c2f88687efe", "value": 221660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781641556, "uuid": "a684471d-b710-4e3e-a3ec-99c619419a5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641556, "uuid": "7cca3f5f-ec25-48e7-93a6-1e1f2c61ec1e", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb6a9c9-6989-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781617677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617677, "uuid": "219f7ca6-b831-487d-9626-eaba4fd10756", "comment": "Malware payload", "value": "6a198a8124a129ce81a939a8de6e3a5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617677, "uuid": "8b5377a8-8f41-4ac6-bf84-10b6ed5899a9", "comment": "Malware payload", "value": "53d42bae989854e446739cd2ee7bad93e40c23d6a55bb9278b9c251db0edd3b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617677, "uuid": "952a62fc-11e2-4d75-82af-298d9f702b0a", "comment": "Malware payload", "value": "2974b14961e9c7f745078e6dd3c0c12196edcd4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617677, "uuid": "7016eb5e-bcce-4040-b432-42c8cb39a5dd", "comment": "Malware payload", "value": "8d5d75b9be9f11c592eb5b41a209d1ff6151af87c2f84e24b66107d4cfd9d2e86ce92026529957473d0c322a649966ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617677, "uuid": "1e3ead85-c508-498e-bcf6-701f1ac3e8a2", "value": "T14C958F9DBD7788DD65CD478C7B8C9162C91734C5D0BA0FEB81322584366AB8A31CDAF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617677, "uuid": "1e479f26-f204-4398-ac1e-bc2d22aee48a", "value": "192:MVrOxVPLWJELG06/Owt7xVaPqwIEQNmcVV/E/PJ1RWNi7iI6LpJ1qgI1q/m6/aIT:5W1hP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781617677, "uuid": "fb22c0c6-0ba0-49af-a117-8017c9f213d0", "value": 2004866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781617677, "uuid": "8ddc66dd-d5ef-4706-9536-f6c11de71f46", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617677, "uuid": "945e16de-12c1-4195-9475-203bd06ea2e3", "value": "Swift-015062026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134b0cf9-6999-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781624159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624159, "uuid": "be7d858b-e261-410e-933d-bbc0925c9fbd", "comment": "Malware payload (Mirai)", "value": "4bdb6ac6fd5ea835fe7e90542865f3d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624159, "uuid": "c494664e-82e6-4de0-896c-1ee479531789", "comment": "Malware payload (Mirai)", "value": "54b54ac344181bc89d80cdf32cdcb21dfb9844cc7bac7147496295956aa5600a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624159, "uuid": "1adbe305-f21a-4ad0-9442-df772271d64c", "comment": "Malware payload (Mirai)", "value": "cf220206195f4904ced16c77ec1e08bf342830ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624159, "uuid": "d567900e-9101-4110-9d9e-bcc3641588d1", "comment": "Malware payload (Mirai)", "value": "ce4aa0707d4d740c3194a33102740a76ed6477c13fe8ce91070bfb1c6ad2681d4726377331ae6992c7be9591004b51bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624159, "uuid": "f165c948-341f-4fdc-a31a-440fc6501802", "value": "T1F7F38D81F743D4FAD95A01B03067E736CB72E439112BFE43D7A9AE32AC92541961B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624159, "uuid": "afd4b752-6e7d-4871-a9c0-ae1293a69c82", "value": "3072:Trgdj+ZdQvWBhAtPROjSA/ghSp/N4G37lC0f6Kvp2xXg/dh8GMqtD:Uj+ZdMWBh8pOjSA/qSFmG3UbXXCzbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781624159, "uuid": "e351fb9c-86d1-4f48-a28a-e79d8725b3ab", "value": 159720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781624159, "uuid": "270c1d43-0186-4ac2-a406-1615986a00ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624159, "uuid": "302a3314-d548-4b63-b353-df421f7d8dc7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2335d1-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607743, "uuid": "e4325ea4-c12e-420d-8aae-c2389ccc69b9", "comment": "Malware payload (SilentNet)", "value": "0caba803f1d8ff7106e8f7344d3f346f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607743, "uuid": "20ad19ed-99ed-470d-b4be-e3848b45a769", "comment": "Malware payload (SilentNet)", "value": "5900dc8f6bd46f3f36be260b6fdea10a767565473571adaefb3e33bf14974624", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607743, "uuid": "7ccd578a-4991-421f-8b48-b351f751df31", "comment": "Malware payload (SilentNet)", "value": "17d985110b4e5a767cb22af3fa91ea1e0e10fff3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607743, "uuid": "c879f40f-66d7-431d-bd0e-135b9f75c96a", "comment": "Malware payload (SilentNet)", "value": "58819d4b942770c607a99724b40816f79b601784d5e8bb9416bc3711c1354bbecb7aead0ebb01cffa933da07e1b6e561", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607743, "uuid": "9a91ed2a-aff6-4d27-8985-02de0eeb1106", "value": "T18496231DFEE2C5A8DB87607107C35223662C52CBE05AC05F89B0199A6C67D3D4B46FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607743, "uuid": "f356e7a2-8f28-48a7-8b6e-31375e0d8294", "value": "196608:ndOO86zyRyFYIn97zmuspPvwb+UzbqLaaV5OuzeETyCcp:dOORzW2YInsbPvDLLV5N6Eub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607743, "uuid": "eea70bb6-c122-43f7-a657-8d30078fc432", "value": 9025104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607743, "uuid": "90743677-3da7-455e-88bc-b08d3f0f6014", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607743, "uuid": "8928359f-29a4-4f9d-95d6-68c9c8ae4c39", "value": "LuminexBeta-1.21.4 (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74192650-6927-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781575359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781575359, "uuid": "f098dfce-4a8d-425d-9e55-0168721cc141", "comment": "Malware payload (Formbook)", "value": "92d6c394b1bf7357ee851b92e80296f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781575359, "uuid": "0e42c746-58b6-421f-969a-6d2c699f79b1", "comment": "Malware payload (Formbook)", "value": "59320d6b1c1e96f31a84f23cfe9bbc36c17100df6ecf94439c90b1fb7af35b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781575359, "uuid": "bb8af790-18b4-4ed6-95c5-9d1bca85a26a", "comment": "Malware payload (Formbook)", "value": "ccb2b65f882fb8f243ad955260d63a6bdc585445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781575359, "uuid": "b5a27a0c-cab7-4f35-bc54-bfbddc768725", "comment": "Malware payload (Formbook)", "value": "a8c927d3c5fb202871a66e4bb273659d1327ca6f252c3b32dd8308bcd6ea53669956ae0ba256983810eade03dc603a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781575359, "uuid": "2c7bb84d-95bf-4d70-ae28-42c0b3f4a0f0", "value": "T10D3512946325C603CA668BB45AB2F27857BE7E9A7821C24A9FD83DEF7831F105D10353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781575359, "uuid": "0ab8c7aa-5f52-42fa-9587-f99a9f991216", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781575359, "uuid": "89de3580-a504-4abe-992d-c565e5cccbf9", "value": "24576:90cz7iIQxfad7Fy5X6v2azlEWt90TdXGI5EexMsxI:VfGtadi6z5EUCTdGV6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781575359, "uuid": "eee9fd47-0abf-4aee-a030-ba7672fd0588", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781575359, "uuid": "6bd6895e-b3a8-42ec-98ff-8f93aedb0e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781575359, "uuid": "000fe051-7d02-486f-91c1-c460d58f13f5", "value": "MV_NM_SAKURA_PRE_ARRIVAL_DOCpdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99367e3-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605648, "uuid": "02327f99-f7ec-43cb-82b5-7b1bff90a485", "comment": "Malware payload", "value": "d07e0f0fef44a8d1dbdf906066650753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605648, "uuid": "21af2de7-e607-48b6-bd1a-e55aefa6eed6", "comment": "Malware payload", "value": "593b613dc890acaf08931ff4708f9fab44b122a70d5341b46ffdfe6dcdfa05bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605648, "uuid": "4a465712-5db6-4813-9ed3-1e9e2f66a97e", "comment": "Malware payload", "value": "9462fc65bbd8785ef5056139fb31ccef5df11f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605648, "uuid": "1844e8ed-1308-425a-a2d5-27c46f43ee74", "comment": "Malware payload", "value": "0af5d205da7d3367779381978ab825e3874560bd1e64a7d6f6714e02d647de0b8746148438bfd5154b984646b8aa0406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605648, "uuid": "4c1708d0-9aaa-4ef0-940e-e9ae7573bc59", "value": "T17346E057FCE228B7C0AAA23189669151BA61BC453F3253D33E90B37C2F72BD09678754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605648, "uuid": "6b3ef8bb-0ca6-4a4a-b761-a23587462aaf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605648, "uuid": "f11fc5ab-ee12-4cbd-9ff7-bb12449fcf95", "value": "98304:1GBXy+89sSsQDETXjWkzk1C+dQYYT+njr:1GyzsQCjWGk1C+dgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605648, "uuid": "06334494-674b-4381-8567-baa399a8347e", "value": 5444880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605648, "uuid": "50c0504c-0278-4494-bcf4-3a10ef7d3a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605648, "uuid": "7e3658d1-6c86-433c-9d0e-64c0d7960501", "value": "593b613dc890acaf08931ff4708f9fab44b122a70d5341b46ffdfe6dcdfa05bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22697be-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607729, "uuid": "5f5ba23f-351a-4ccf-bec9-b028e5a85e4a", "comment": "Malware payload (SilentNet)", "value": "4bceda284d6ed2cd19cb7f0d06dbe9ea", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607729, "uuid": "ecbd9d92-0c76-457c-ba47-44b98ed2409a", "comment": "Malware payload (SilentNet)", "value": "5a0e43a7000b5f87cdfaf036a84d2d0bfa70e0d69231f22fea3f2ed23e503412", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607729, "uuid": "85650493-e010-4824-b3d9-b3a215d533af", "comment": "Malware payload (SilentNet)", "value": "d8c2ce2fa25d3f6b38ee9382890045e4dc41721e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607729, "uuid": "4b74ecd3-17b4-40ad-9757-ebba2cb369ff", "comment": "Malware payload (SilentNet)", "value": "31c1871d673450db001568fa41d131f8e0ee564219f741eb9df13a3f18dc1e543bbc355edbf97a6a43b339a8c2fc178b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607729, "uuid": "d21456f8-3a9d-40b3-90f8-415c23769e30", "value": "T14FE53390F2F48603E19764F68687C0D744562BC7E5250A9E09E73BEB5CE97BCBC9088D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607729, "uuid": "c0ea4f0c-dbe5-4d43-9a76-057c07999b53", "value": "49152:mmEZAitMtgHFXl32NjN5C6Zjb4dKG7gfs+oqxz2UKHVgrlfJA/TzWZZxZO9la8:mj5ENHCxBgzhxJriKhZUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607729, "uuid": "8f6b535f-1514-4a02-8af7-2050781f3fd8", "value": 3148898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607729, "uuid": "5f9107b1-d5ef-410d-8d2d-98f8ce9f87e6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607729, "uuid": "abfc41c0-ba30-4c16-a04f-9f95212d0466", "value": "doomsday-1.21-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64527d4-6997-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623681, "uuid": "f77c8215-dc09-4497-9563-93fc4a55b101", "comment": "Malware payload (Mirai)", "value": "309ed29db722fd46ff7a4f0f9d360c51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623681, "uuid": "3d97b4c5-d445-4e52-8c56-958a0fa1c7cc", "comment": "Malware payload (Mirai)", "value": "5a25ebabcd8c8320204300b976f8cf4617cce75cb6d26cf80b06a6e3a0936143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623681, "uuid": "10658fab-9743-442d-a1f0-67cc5f60e73d", "comment": "Malware payload (Mirai)", "value": "513a6de8a7c913986528553ad724248f67e07ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623681, "uuid": "4babb539-db70-4625-98d2-e6cfbdaa432b", "comment": "Malware payload (Mirai)", "value": "0cee19eb4ac6f1212cff65e11de7c0bc98a3ae4aec8bdc6889b5edcf7ffe6ac3c27f5da423816ce7af5d8e6899b66c22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623681, "uuid": "43a336fc-65ea-4e3b-a477-b51961e6b011", "value": "T13944C41F6E229F7DF269877447B78E24979832D626E1D6C1D1ACC2101E6038E542FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623681, "uuid": "f0a86385-981d-4c57-b8ca-52cc6dce099a", "value": "6144:LmK/qQkwSFEDEpXv8aaORBzsadAV8Qr8fKn:LmSDEyQBzQofM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623681, "uuid": "47a60baf-5f10-45df-bb2d-149cabccbbd8", "value": 273968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623681, "uuid": "4feb3de2-4c58-408b-99fd-c2ef7b7acf0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623681, "uuid": "424d166a-01d5-42c7-af69-21884e87ee0a", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c013890b-696f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781606410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606410, "uuid": "0b9ab06f-ab9a-474d-8aa7-ad2dc06b545b", "comment": "Malware payload", "value": "cc0db8ac9567a6c36cd95cf33443cfda", "object_relation": "md5", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606410, "uuid": "f94a22e9-5ed3-45a3-b99b-f9431ed636a2", "comment": "Malware payload", "value": "5a6b70024cff8679fc0b03979eaa096cfde2b7153a35c523a4a41926b30c03bb", "object_relation": "sha256", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606410, "uuid": "5b308cbe-f917-4814-89fd-cb5cff6f8373", "comment": "Malware payload", "value": "9a7c0a619cdf8feaee53b5a9369f3e97048c2168", "object_relation": "sha1", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606410, "uuid": "bb062167-bec6-4457-9b51-8e2f6f973066", "comment": "Malware payload", "value": "5d04c4029d7cb9d22cda0e041fda40a828ee7d0fa3187490acbc4bb758504fda7e7303d1e1e8d880e9de57eeef2ae19b", "object_relation": "sha3-384", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606410, "uuid": "064e950a-3a70-438e-8f9d-164ee5ab94ef", "value": "T1DC85CE0573A442ADFEABE1768A12C517C7B17C450637861F06A0AE777F33B716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606410, "uuid": "c6597d8a-3150-4381-8035-d89fbe876e74", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606410, "uuid": "ca91a74e-1f86-4bd5-939a-966320ab54a5", "value": "24576:7CZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrPXAas1cNUtwLID0Lpu8XcWJ8Y9ivdH:c1H4jR2TYrQbDTrPFO4FcmZMlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606410, "uuid": "e7c0b5c4-5c13-4cd5-9257-13168d6c2abd", "value": 1866752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606410, "uuid": "c9096545-466c-41a5-926e-8392ee1cbc00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606410, "uuid": "fb1c6860-9dec-45c4-9df9-e7056c062744", "value": "5a6b70024cff8679fc0b03979eaa096cfde2b7153a35c523a4a41926b30c03bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3b621a-69b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781634701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781634701, "uuid": "8aff569c-dd6d-48b8-b222-bde303ce4572", "comment": "Malware payload", "value": "cdb287a88dbe4bd81040196b477ba600", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781634701, "uuid": "faa2af84-1f3d-4ba3-88d8-dfb2c2b1d22c", "comment": "Malware payload", "value": "5c495947a2118f629e5e16dfe815bdb4b17ffc649a022864736681f7317b9165", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781634701, "uuid": "b45bb127-c041-4216-bc86-0c53a4ca5561", "comment": "Malware payload", "value": "75e6e93033f0e1aea3cbeae2db51fcae63e85e42", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781634701, "uuid": "55698249-2323-4593-a97f-3b18c6f50387", "comment": "Malware payload", "value": "17d20314365a2f218402a04df3f7e9eb9333355c50f1479cc002bb0f191b634f8500d0d64f7fcbb4e8b1e643cda53dd5", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781634701, "uuid": "e1cc1d80-9152-4429-aa10-efed0f1a0467", "value": "T130E4125727F930E5E67A8B75C1004649E776F87217604BEF43A4129A2F271E24E3AF32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781634701, "uuid": "309521c6-da72-4776-9cfd-5ec532e3bcf6", "value": "9e863d6d70de61babc501596525204f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781634701, "uuid": "9092ae9c-283e-453d-874a-5ac131c47d36", "value": "12288:wrCmBGAWvZ989BiWnPASYcjHWvsCd3JK45pqZs0qo5mpnOWrPF5:wZWvL89BijTZX50s0qJOWrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781634701, "uuid": "77b885c7-f876-437f-8120-ea164f2745c3", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781634701, "uuid": "dee7da67-bde5-4f67-b83a-b18532435921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781634701, "uuid": "3c0457f5-aeb3-453b-b218-ff98d5ec9ec8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0545d1-696f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781606402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606402, "uuid": "28cf852d-ef5b-4224-925f-bb48687c190c", "comment": "Malware payload", "value": "2d1a4f6cb193a8e42bf98a0dbcd3e33d", "object_relation": "md5", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606402, "uuid": "60a75b33-51a2-4393-aef9-be495d0e39c9", "comment": "Malware payload", "value": "5e5bc84689c374a2f1ab4c55530e87c9cbfd3fbe98483f211a46ce7883c57aa0", "object_relation": "sha256", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606402, "uuid": "e49b0248-9404-4aec-9a35-995ea44f8d1a", "comment": "Malware payload", "value": "1edf283f01f5c3b237cf2007d9720ca6560a92c1", "object_relation": "sha1", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606402, "uuid": "50dbcf9f-88ce-4793-9aa2-4fb7135499ed", "comment": "Malware payload", "value": "899e35d37675338d120b0115a874431d560e28f372a86633ef661977ef58fd0a62952b141507d728985d4568d0015e50", "object_relation": "sha3-384", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606402, "uuid": "1e439679-d4e8-45e3-b66d-08e9a73a3fd3", "value": "T14456C013B299253EE87B1A36483F9754983B7EA126924C0797F42A4CCF7E5401D3AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606402, "uuid": "466c153d-ff2d-46bd-a450-ac7bc3f14d0e", "value": "ebf9f50934ebfc138912ce0c5847005a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606402, "uuid": "8629ed1d-8c0f-472e-b6e8-a859786fb6c0", "value": "98304:lIS6/e7gju6UY3Q0YPEgRHTsm+MCvkBpeq/2:uSwUY3Q0YPppsm+MCMfeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606402, "uuid": "ba5cb82c-b9f3-4270-9362-1ad6a2b4a560", "value": 6046221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606402, "uuid": "47b761e1-13e9-43a4-b861-5fb209d009e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606402, "uuid": "ea00ba89-35be-49d0-8e38-a3ee20edca49", "value": "5e5bc84689c374a2f1ab4c55530e87c9cbfd3fbe98483f211a46ce7883c57aa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d11ea27-6978-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781610110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610110, "uuid": "aa4a8f87-244b-4cc3-804e-d97ecce7d656", "comment": "Malware payload", "value": "6015855dd2d90f8a38b7d8e7188806cf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610110, "uuid": "98f2e76e-a5ba-4326-ab13-ad6248747496", "comment": "Malware payload", "value": "5f3ad7b06e19a4bd5bdb522cd41ca313b0c89c0840cdefa75639231a81e4c8bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610110, "uuid": "a9b1bf6a-c6cd-417e-acdb-ba8c6951f9e8", "comment": "Malware payload", "value": "10caba45fa4a4b1df68998c163d89b0c921b6c6b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610110, "uuid": "b549a50e-b44b-40f3-a33c-84750121ed6b", "comment": "Malware payload", "value": "05b9b738e73084d9398a88eaabfc4295f30ba0889f5eeeeade87c57e617257bfad2a09fe88759dc485d238055e13b8fe", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610110, "uuid": "94624a57-8024-494b-a872-b9674a527dcc", "value": "T1F1916C71C1486D9EE28F82BB070F9F8BCE2EA69DD9611722064E17535E3F198A134954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610110, "uuid": "074b5f85-ef98-4cfc-82d0-c38866c8a675", "value": "96:hrSLh3f3/2brHm7gZRPsLQdGQ+NpsTL7rJKOOJTeEiFTu3Y7nDLxo+eO:oLhHorTbsuGQ7H7rJQeX72+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781610110, "uuid": "91aa3d36-4965-49a6-a334-c3b0f544e7f1", "value": 4585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781610110, "uuid": "7924c0da-84e3-40ad-8aac-414cdaf3b1b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610110, "uuid": "4929be6b-5125-4567-bb30-52a14d8fd2c1", "value": "invites.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fa4e65-6985-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1781615757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615757, "uuid": "66196579-1ebf-483c-9899-e64283fe437e", "comment": "Malware payload (Stealc)", "value": "d94999c701738da0dd72cffe8c9ac30d", "object_relation": "md5", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615757, "uuid": "cff98f3d-6ffe-4cee-a4fc-5d9d6b5a2219", "comment": "Malware payload (Stealc)", "value": "61e14086ff1b7559ce908651269a3d734d69f144a985d8e21791199ba954b532", "object_relation": "sha256", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615757, "uuid": "8a632a03-db3d-4149-869b-d7edc6f3e4f5", "comment": "Malware payload (Stealc)", "value": "da897a1b9ae473115c65570684452efdb41e1ec4", "object_relation": "sha1", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615757, "uuid": "f0bb9494-788c-4c03-b501-26075e7bfc03", "comment": "Malware payload (Stealc)", "value": "3813ea71f765004b42485e2d4fc1a9ad606ab1daa4a3339685cf8477cd9c79e97fd741e295b6c5ff01815b4f2f0baa13", "object_relation": "sha3-384", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615757, "uuid": "2e8775eb-e394-4cee-aa6b-2f247f8594c8", "value": "T13CE4AF22B6519065F4EB0E358E64AE52BBBF787007109BC723CC06F91E719817F26F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615757, "uuid": "bbc1ac79-3b94-4efb-92dc-f198b38e0024", "value": "12288:qa9Q/JFek1vXkbfx3JV3Xafy/xdfyug8FrBNvsAHl7mdRgV:qaYJowkDRDEAPfyIVmdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781615757, "uuid": "5bb06c4a-97b4-47f7-ae09-3f119002438e", "value": 664445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781615757, "uuid": "bbe89bab-7d12-4dc5-a5c2-1b291720026b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615757, "uuid": "fd1159e2-7c9c-4ab8-89bd-2f8757eb6e5a", "value": "178160148549730845678d6cb42fa2bbd731d7b274e3d5802aa80eba5d22b025f5eb8890de363.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a4045a-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607780, "uuid": "87957677-7299-4af7-a122-566181153163", "comment": "Malware payload (SilentNet)", "value": "02474c576e5331d0d45920222da85430", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607780, "uuid": "74cf323c-99aa-404a-825c-8784f309e2a8", "comment": "Malware payload (SilentNet)", "value": "61e1cf418621e1fb905ab56c1373fdd6e29b3f2409324fcbfcd2e17c4cc7b260", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607780, "uuid": "5dfcb329-c7e0-45f0-a518-68e1c85ec00f", "comment": "Malware payload (SilentNet)", "value": "fcbcd7a61823c5a5fba1a7c92b009fee534aec8b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607780, "uuid": "7ad1ca43-f255-4b7f-ab07-03c7d445da78", "comment": "Malware payload (SilentNet)", "value": "672032398184d0a93b7aaf2b649dba39147b2c2cd9a89c53e73fbb7990de66f34f4fb97a4f68420bf95ccd157479489c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607780, "uuid": "79188ddd-6df0-467e-b6e9-989f0e0ec0a4", "value": "T170C302627D01C969C66EBFF44F94947732B168F1570E90BB2583AE5F082E8441E4AFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607780, "uuid": "0e074b1e-3f6e-436e-aa28-96e068ca43ad", "value": "3072:Q4A2zL5gGYtXufgFxdfF/imXUH3GpFaMPM/Y:Y2zPiX5FfZiCaVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607780, "uuid": "0e03641b-6e31-4249-bb6b-ae9db3e6ce54", "value": 128641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607780, "uuid": "bf1b51c7-dfd3-48dc-817d-ce59e52f8619", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607780, "uuid": "d2e215bd-43ba-47ec-b3a5-a23b83662246", "value": "SmartTweaks-0.2.8_BETA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099744ad-6966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781602239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602239, "uuid": "320b3218-ca18-4eb5-86c7-136c3a1e3c56", "comment": "Malware payload", "value": "ed44e314b06fb530af9906abc50b8683", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602239, "uuid": "d90e06bd-d36d-45c8-b283-246672b6f623", "comment": "Malware payload", "value": "63b61e78df22d07e318ed7af0dfd978cd7ad626c5b49bb737214a2311f828011", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602239, "uuid": "62bf8f7b-2df6-4cfe-bfc6-b1e4af9bb86f", "comment": "Malware payload", "value": "03cae596b6f362a8226f173b36831eb50c725e50", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602239, "uuid": "0f96dec5-11da-438e-b65f-7c6d57862ea4", "comment": "Malware payload", "value": "6d2cac63757d540492591306ed73858b6c8eda7590fffeb0049ee515197fc9341e19a0738813528b17e5cc5ea33481c1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602239, "uuid": "7f29b15e-9f00-4c0d-8b44-10dd65ab2c8d", "value": "T1982522EBE331F8F6C334A2F5661F0352FC7CE58A8639A702912F61B1AE4B525034565B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602239, "uuid": "578f4d08-b8c7-4d09-8072-211074431226", "value": "24576:lhCM0A6zc0aijvhsxavdlaJDmp4f1oFkEXkcIGBZmOoA:lhf0Ao+wpsx0d8mg1+AGaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781602239, "uuid": "4798a665-ccb3-436f-90f5-53d8430b6b7a", "value": 1030594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781602239, "uuid": "7c33a6ae-667c-47a8-bfdb-3644a4a923c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602239, "uuid": "c3e4384a-df51-4831-af14-4decd4904324", "value": "\u0437\u0430\u0441\u0435\u0434\u0430\u043d\u0438\u044f_\u0421\u0432\u044f\u0449\u0435\u043d\u043d\u043e\u0433\u043e_\u0421\u0438\u043d\u043e\u0434\u0430_\u0420\u0443\u0441\u0441\u043a\u043e\u0439_\u041f\u0440\u0430\u0432\u043e\u0441\u043b\u0430\u0432\u043d\u043e\u0439_\u0426\u0435\u0440\u043a\u0432\u0438.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac77ff69-697a-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781611102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611102, "uuid": "6de26523-4a5f-4e73-992e-bb605e47868f", "comment": "Malware payload (SilentNet)", "value": "f820a10d72c6eaa6d386c2fff7b34220", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611102, "uuid": "c418cbef-2b97-49ff-aba3-a4bbb4b953a3", "comment": "Malware payload (SilentNet)", "value": "64d360b9906bf4f98ace2f6f7f74e373d2ad3cdbeccb9997650e47bf56d5ec00", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611102, "uuid": "dbb4a1ce-7e95-40ec-ac80-a8faa6549290", "comment": "Malware payload (SilentNet)", "value": "6dd5bb2c2d5ca8b4e387d0ad8c6509fdd5067df6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611102, "uuid": "0f0fb634-769c-4a0b-a1ab-b457ff861b25", "comment": "Malware payload (SilentNet)", "value": "74093c6dcbe4016532ce949af2fa90b781bc183b6b38985a055239a03f8af9ecb364fa7f8e864fabe8c26eea10a2d689", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611102, "uuid": "70fd9eab-fd93-452d-b6a3-acef2933dad0", "value": "T1231533C506D6980FCBE9EA34485CB788DFA2A205E52D74F01D658500E6F16BBCEB1F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611102, "uuid": "976740f7-2dfa-41b4-b00b-c17116d8dd78", "value": "24576:+LULMOv3fWdrY7V86l3vcqo4HF3lxQcLDUX:0vO/fZJ86l841X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611102, "uuid": "a5823f2e-8290-45d1-9f2d-552ab1be8d4a", "value": 876574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611102, "uuid": "c761b315-f1e7-4201-8734-cd38171f50bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611102, "uuid": "d277f8b9-3797-46d9-9df3-b68687d3b888", "value": "donut-dupe-1.0.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc20c92-6997-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781623375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623375, "uuid": "b5c4f9f3-e8c0-4ab0-8894-6140e2edec97", "comment": "Malware payload", "value": "76b9440fd68045212a3b642794bfd61b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623375, "uuid": "6481547f-8557-4e04-a6aa-b10e61fddf74", "comment": "Malware payload", "value": "64dae7084b1857a52f2e4aa6ef72a142747f9e7f1ad7223c18ab4fa6e62897f6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623375, "uuid": "fcd50b45-c612-4ae1-8802-42344337cc49", "comment": "Malware payload", "value": "36b23beb879b6d79ba3e3dca206d64382e3ba393", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623375, "uuid": "6838b321-5055-4b20-a50f-0ffed0493ba2", "comment": "Malware payload", "value": "54cd034a3f69dc0782c1ed089bfa0b85c7969256c2f7f75e342ec2dc7d0d529ca7941a5cb3d8919caec47d2fce2c2b8d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623375, "uuid": "0793895a-d139-4049-bdac-8f7d5611655a", "value": "T13C136D6526953C25AE99883B5D7F2F0CB9A983E2304491DDBF8A3CF18C15A9CE31871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623375, "uuid": "c82dc646-3d20-433d-999d-2a6f3c297fc4", "value": "768:er9NyXsZztC89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:oHusZYco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623375, "uuid": "bee61b16-205a-4dc6-88ec-e469e7ba2ab6", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623375, "uuid": "0cf7b99d-6bf1-4874-9c49-8c90f2523ba8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623375, "uuid": "c09ec84a-3e5b-484b-8404-80fc7d5b5c06", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a78c9f-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605432, "uuid": "df462c43-d232-4553-b168-8d8ad8a456c0", "comment": "Malware payload", "value": "09dcc0819914bb9ff59495add5dd263a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605432, "uuid": "564205be-3074-4c31-91ed-514147b2dd38", "comment": "Malware payload", "value": "6630b8cdaecafa99f0e4798db4a6802f5fe360a4897c62a3360af85dce3af960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605432, "uuid": "68ad735b-d4d8-4ac3-b0f8-055ee3b63ba9", "comment": "Malware payload", "value": "4bdb3df77c06789687cdeab3fbf6c502d56e0ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605432, "uuid": "4fd51a2e-cbc7-49cc-acc1-2fce89c695ac", "comment": "Malware payload", "value": "94951d1bc7685c02d79b7fb51716a67b45cc68a7f0e8f03cdd3316a8863f6b072799bc7a42ffd2e8a053d2ee121014ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605432, "uuid": "987f1803-a5cd-422f-8f10-8871937e9fa0", "value": "T12B769E02E8A22DDBCA17D5BCD8255895BFD6BD80571202EF31B4A3612EF37D0163E71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605432, "uuid": "02c6d2f3-0445-486a-9314-4b9738dc7576", "value": "d203f9672085bd7924a65988545977e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605432, "uuid": "618c0b2b-6c33-4083-9e99-1900fc60e51c", "value": "49152:fPnp84Yh3Imhtx/RLgpgD5N0QSKGF/YCpWX/k1BMGY:fq1LgWX053fpWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605432, "uuid": "edfc13aa-808c-40a7-a56d-2b7155136c2b", "value": 7797816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605432, "uuid": "71b01329-ccb9-4a87-a60b-5dac23d2d24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605432, "uuid": "84345ad1-1e5e-43c9-a6c6-58730225e83c", "value": "6630b8cdaecafa99f0e4798db4a6802f5fe360a4897c62a3360af85dce3af960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6e1ebc-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625540, "uuid": "1bff88cb-a895-41ef-bc00-799281a1b8f4", "comment": "Malware payload (Mirai)", "value": "7bc61634910eecc4b1a2a45129f886d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625540, "uuid": "b0ec5542-534a-4127-9eab-6b69aa5d4475", "comment": "Malware payload (Mirai)", "value": "6691d368dd2efa53408a5ee23b01d9bf1c74a51c6899ca59a91448dfc74c4422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625540, "uuid": "798024ef-4644-4ebc-9e84-151fb43c846b", "comment": "Malware payload (Mirai)", "value": "af74fd0c17637af0ee36a5e475c8f47927802450", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625540, "uuid": "6bea68f7-4890-419a-8f0f-ae93bfbe9fbc", "comment": "Malware payload (Mirai)", "value": "2cdc7e481597ecdde71dfd7accae51f2cdd89e598825c01b0190eb96ac32fbc7831598d1570c470d836c0f9c504d5823", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625540, "uuid": "b238909a-170b-49a7-b5ff-0b620ac805bf", "value": "T113038EB7C42DBE84D1495634A5248E781B13E145A7932FFA1E69846E8083EFCF70A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625540, "uuid": "a2de935b-622a-4420-966c-8b916e816cdb", "value": "768:na8A5wtSjRPlyo9be2QDHzIqqCUVYJC3rCBopeP0Cy:nar5wtiVWT8qQJ4P0Cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625540, "uuid": "a50d9ba6-8fae-4a84-b3cf-13bbb8abee5a", "value": 39720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625540, "uuid": "97602887-fc86-4c3b-82fc-1a70a9b7a3d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625540, "uuid": "e5256b77-fe0a-4747-a499-8c17d940e6e3", "value": "d0e001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b14bdb-6994-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621987, "uuid": "9c27c970-6329-4f58-ac60-692fdba24ca3", "comment": "Malware payload (Mirai)", "value": "b29a133f123b19e27a49d05bf01bf79d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621987, "uuid": "71108250-b566-4b41-a49a-13922c7cd8e2", "comment": "Malware payload (Mirai)", "value": "66ef8da9addeba0e7de0fefae2d0c33c29d2442894950d2244ab04883da30fb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621987, "uuid": "062c4bcb-d468-4fdd-a289-d7e05108cb59", "comment": "Malware payload (Mirai)", "value": "6f18509a7c0cb45816eb0163359596d240f4e3ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621987, "uuid": "00605867-ad03-4960-9743-751d70d385c6", "comment": "Malware payload (Mirai)", "value": "3440916433267db17cfec37393369e8ae5d583fbb2f8218776c7b065aa4917885b9d80498786aace276b35dc1129e9be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621987, "uuid": "052981bc-ab97-4026-b844-de808588e817", "value": "T1ED14AE23E4796EE8D52498B4F4F09F781753A61541572EBB2AA6C57480C7E8CF90C3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621987, "uuid": "0304160b-4bcb-44da-9e76-7bcbcdbf077b", "value": "3072:H5iTEiKfB6x/mjpw3TCPYUdax/+7WYdLUijgeo:ZS8W/m6jCPYwNqYaij2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621987, "uuid": "704f4a21-c13d-4463-9412-db26ce0aefa4", "value": 191364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621987, "uuid": "cef693f6-e4f8-40ac-b3e9-fead89f26553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621987, "uuid": "b4bcb0af-2925-4873-bfa8-fb08d058757c", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8319037-69c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781644220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644220, "uuid": "5399ba3b-c9d1-4995-bd13-b1342237e0d5", "comment": "Malware payload (Mirai)", "value": "5853b2d8e7e8ea00d8be1376a6e57b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644220, "uuid": "efbd5af8-d173-4c2a-a3a8-51324fa3b23e", "comment": "Malware payload (Mirai)", "value": "675a74034cf2d64e8529686fefb3e33816cf14352375d07763280006b658c74b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644220, "uuid": "81962799-5a8a-4921-9d2b-807b620f5cc3", "comment": "Malware payload (Mirai)", "value": "d53d2ab27df90f308ed742cd07916c11b7a52403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644220, "uuid": "fc07cfb5-8613-4730-8da8-699a08f78f95", "comment": "Malware payload (Mirai)", "value": "eae6b7a8e1af14b9f91006163f4429dc7c1859525035758b1c5928514e0c5d7cfb7a3304960212f70cde59389962cd33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644220, "uuid": "7080f5cb-e70f-4fb8-a3ac-ef22ddd97c46", "value": "T193F3C80A9F910EBBDCAFDD3702E90A1539CCA54722A43B753674D528F54E90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644220, "uuid": "b5a90195-c05d-4799-9d87-062bd895a21b", "value": "3072:BoJoyP15kRjFdFcm8PCjm8xt/2BzJ5rk:SoltFcmRp+xrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781644220, "uuid": "51b09d2b-667a-4546-8a4e-04ce7e760ac0", "value": 161220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781644220, "uuid": "6e7794ea-c669-443b-b847-52daaae46e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644220, "uuid": "3d733a3b-9fc7-4606-972b-87143c04b7c4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76639a0-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608543, "uuid": "bccb5cda-6a78-420f-a27a-91092afa52fb", "comment": "Malware payload (Mirai)", "value": "086d9380a3f2d6af3dce777a6c50c25e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608543, "uuid": "b16d7f20-82ef-4bbf-8501-e7441dbedefe", "comment": "Malware payload (Mirai)", "value": "68b47467ce295f075dde9fa2e15951e800616584f081cf86c9c9bdbdcfd33265", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608543, "uuid": "5a749b43-9bfc-4900-b663-3a5fb51fd6db", "comment": "Malware payload (Mirai)", "value": "cfa341e2fecda645a8aa651fe3181a2669b0db7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608543, "uuid": "182ce1f1-6791-40bc-80c0-fe5ec7cd6d4d", "comment": "Malware payload (Mirai)", "value": "1552177a8905e65a019b28fead8c431ce415d7c5bf968dfcf1e9a0c00cb23c9f4a61b3a04cb2d3ca5a033f98d76e8700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608543, "uuid": "bd250bf3-fbe8-4e49-84ce-7e6bec866a0c", "value": "T17564A733C82589A5E0108CB2226736419D4787BF88EB26D3ED6A59A0FF3545F51BFEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608543, "uuid": "9a8e6cf1-3be9-4791-9066-5aa98b219841", "value": "6144:Yec7yz4fSjMYxzwjokerZmaXtsrHqaK1N/:Yef4M/Jwj1SZmaXtsrHqaK1N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608543, "uuid": "52d57102-a829-4fae-ace3-4664f1afa5c6", "value": 336726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608543, "uuid": "e636f13c-a09f-4298-8cc2-f9410aee0570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608543, "uuid": "f6b9c5e7-b219-43a8-b28d-dde9ec7d3fac", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf96958-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781608979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608979, "uuid": "182566e1-4087-4480-bdf3-cf31c014955b", "comment": "Malware payload (Kimsuky)", "value": "1129182ed260c56d1a5b8c475e94d7b5", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608979, "uuid": "9c99f320-f96d-4b2b-8453-04285090022f", "comment": "Malware payload (Kimsuky)", "value": "6b71c57d941fc5ffac7d064a9c295320d3d0425a46fd79c48498b7997e12746e", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608979, "uuid": "ae8deb55-ad8d-4f8b-949d-9dee94a7c5d6", "comment": "Malware payload (Kimsuky)", "value": "5caacc36c5e3f6fca3f27ff731581a7217fb8749", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608979, "uuid": "26e45d9e-a06c-421c-b669-91fae1ba8973", "comment": "Malware payload (Kimsuky)", "value": "a4a0b8a6b736c49950a1ffbda3a92e803ebab44c0ccfee7a7ef7d9f51661eb9f603a71e09a78cf04ae5127482769cc7c", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608979, "uuid": "16c94f55-c487-405a-929b-27147599dfb6", "value": "T14AA2A8C37602D3C676C552C7628FE8CD3F08C47902AB46A0F8DF4B5D535ED89A2A8B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608979, "uuid": "dfb22382-4f3a-4543-8cd9-60828e611ba4", "value": "384:1Qum2uNFfU9zHzQQtgZ25QGxpKjscm2EucCA+6Q2O9R+8/kQzLQUX7EMD0v5TiDM:1Qum2uNFfU9zHzQQtgZ25QGxXcdE/CAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608979, "uuid": "f7d9f52d-a32c-4934-8d75-0c51fb5260f6", "value": 22575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608979, "uuid": "2c6fc935-2af1-45e2-9235-5bd1cf23a52f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608979, "uuid": "e53d6f3d-df40-4fa9-abb7-2500e435f964", "value": "6b71c57d941fc5ffac7d064a9c295320d3d0425a46fd79c48498b7997e12746e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392f2a6e-6923-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781573542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781573542, "uuid": "10132a69-4815-440b-84db-343476ba7651", "comment": "Malware payload (MassLogger)", "value": "2be1d5da11c637acc2385451a8de7697", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781573542, "uuid": "c87a1012-3cdd-4d67-b220-064efc6ac11f", "comment": "Malware payload (MassLogger)", "value": "6cd900620e1ca921c028ad02e78e082d90351ec2a96c34ac532249f5fea16c3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781573542, "uuid": "d7ce5ab7-e9ce-492d-b88a-465113e1baf4", "comment": "Malware payload (MassLogger)", "value": "9f2f792f361a975b7a212a330ef934b49ae5568c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781573542, "uuid": "96eaeb36-e96d-44bd-838e-20e4301a10a5", "comment": "Malware payload (MassLogger)", "value": "34cdb4230bc2280ee9ef74f2aed17bb799c075fab4267a598a072889d624d38f415457ba62d3026da159efcb433d21bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781573542, "uuid": "b7c136ef-3eda-4518-a139-2cfb55ee5584", "value": "T1AC16D43CCC94012EE277D919C8A7055FE9936A0B633CE91B50DE674B1F23882BB9635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781573542, "uuid": "64ae1bfb-05ec-4f31-a6a8-1e78a7008ada", "value": "3072:WNh+4yeEvvpl9adRZpJcatYhR5fssVbdKZjHtakmR4RK3U9IZyWe05BMSUIbAk//:DeEnpaNpJcdhswcZJrFr4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781573542, "uuid": "94ea18cb-95db-4df5-96cc-d73e2e76868e", "value": 4069946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781573542, "uuid": "8e8c1adb-53e9-40b6-a452-830b87921053", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781573542, "uuid": "3f9d74b8-792e-4157-b162-3fffc511e5a9", "value": "RFQ-3L50051061.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9402a526-6988-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781617074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617074, "uuid": "ab90ae11-301d-47bd-bccb-39fccdfbd6ef", "comment": "Malware payload (ValleyRAT)", "value": "03ca8ef33e6ab22a74c6848dd888c41d", "object_relation": "md5", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617074, "uuid": "9bab8fb0-c8f1-4172-8d17-87e8b2741e5c", "comment": "Malware payload (ValleyRAT)", "value": "6f01bc9e92bbf3271bd6e1b113d96a424144cb8fc4584d7f9a2ebff55f49af6a", "object_relation": "sha256", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617074, "uuid": "c8431d40-fa48-4c70-bf76-01fa057512bd", "comment": "Malware payload (ValleyRAT)", "value": "df51bf06f70980c0e3691400fdb1b8272b7fcb1f", "object_relation": "sha1", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617074, "uuid": "a430a3a0-05d8-4502-87ad-243930b118a4", "comment": "Malware payload (ValleyRAT)", "value": "0aaa27d8cbd9b3644c2005add1317474b6d831af849a9eba5c23b90b422d686a30b35fdf54873189cdaaec8d0471fab9", "object_relation": "sha3-384", "Tag": [ { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617074, "uuid": "cf5e4b85-d1a2-40e7-83f0-140beca1c9c8", "value": "T1ACD6335BB7CB96B5C08FC334C556E50E70663FE0AF268C193AD879480E7663459FA30A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617074, "uuid": "fb975e36-a6b4-49ba-b456-53b85812dbe0", "value": "393216:E7irGAqva0RUnV1LqzRxqHDnL2gmn3CO0w7:E76G5vtcOdwrL2Bnd0w7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781617074, "uuid": "40895c3d-9ef0-4816-8131-aa3a30428082", "value": 13299712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781617074, "uuid": "355135c2-0bfc-4cba-ae3c-53cff5e71d5c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617074, "uuid": "fdf91847-4263-48d9-9829-bf7eb493ab88", "value": "ainstdown65561002.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f88b8b-6996-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781623141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623141, "uuid": "4b543df3-081f-438d-a9cd-1c3c4310c3f3", "comment": "Malware payload", "value": "55edb851f0df88c83a14f27bf9f308a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623141, "uuid": "38538c78-ffc0-4bec-b6fc-c282b1c48b57", "comment": "Malware payload", "value": "6f2f464e992c5ae5bd5e94ed236e6d30ff82985dfdfa68c87df10195e75000af", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623141, "uuid": "d0fae1d1-c20e-4402-8ade-b3a04a421d07", "comment": "Malware payload", "value": "f61d4a97ac53be351096732a481b50f7311e89b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623141, "uuid": "a25cd92e-29ea-4961-9545-6e0840b84744", "comment": "Malware payload", "value": "c558cc0137d4b259b5e9b0ea1c073292cad359965e3a9cfea6004b55f32100317d0aad490cce7a3d4fdea2cf4f76d5a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623141, "uuid": "7180429a-60b3-4b77-8b87-f91b75fa0edf", "value": "T177B092F90C305D4E8001C5CB73B00606A0216DCF6DFF42DCA99507B9000E487FE06E00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623141, "uuid": "9c6c0490-b93a-4c2c-a6cd-274a97da3086", "value": "3:Q1iLDgVTLFftHpFDzCLDgVTLFftHDOOdom2CaYyERv:ooDgVHFftp1IDgVHFftD8m2CaYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623141, "uuid": "f7f420e8-9629-425e-939f-c64801097a94", "value": 118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623141, "uuid": "901f00ad-84f2-4f94-83bc-0709134eff91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623141, "uuid": "79d2b935-0b81-409b-972f-c2d2c3db4c3c", "value": "check.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70594b5a-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625604, "uuid": "9c46f403-4ca0-4dc6-9c6c-c698d8690dc3", "comment": "Malware payload (Mirai)", "value": "b1e404e04a820e5c693a850556a3cbc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625604, "uuid": "17b9dd0a-43eb-4cae-9e4d-f851cc2fe192", "comment": "Malware payload (Mirai)", "value": "6f32da872345812dbe8756b23f7c99c73acfc541a04bf4f7d1cc80ef5d888e83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625604, "uuid": "1cfe8425-0538-4924-9170-d60e1f869f2b", "comment": "Malware payload (Mirai)", "value": "e6a312bab00b078bdd2ad5ff80c1423820484a7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625604, "uuid": "a3ec57a9-038c-4efa-9a9e-f5ea0c22789c", "comment": "Malware payload (Mirai)", "value": "989f5c371582ee75d4ba40d6af06ca94991fb1f441aec3454c83f2469408f06bfacd398c680b73e3bf4db7601634714f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625604, "uuid": "43a078fc-246b-4f24-a885-d95d5e128c36", "value": "T13F330A96BC818A12C5D413BAFE2E118D33236768E3DF7212DD116F24778696F0E7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625604, "uuid": "9bd0fd8a-ba99-473a-ade8-a36b0a364985", "value": "1536:A9nyvTS5/HZYYNilUBvC7MVhL5IWizdEe48y:r0/55NSUBbydEe48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625604, "uuid": "2f31ef73-1c0a-4d83-af74-39944855dc87", "value": 54608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625604, "uuid": "2ea98c9e-60ff-4540-af86-4355eb50e0b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625604, "uuid": "f76dba27-b38b-4863-989e-0a5a7c8d7d8d", "value": "ac03c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f492f3-698c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781618708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618708, "uuid": "3f2a60f7-1e5e-44fb-9e91-58a43855d53f", "comment": "Malware payload", "value": "bc048be5b341cf6487ff4eeffba8e6a9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618708, "uuid": "4d4aa107-69b9-4cea-a65f-100db6b4cdd1", "comment": "Malware payload", "value": "6f45528998b3a03de4027b6efe05c1674d049e456f04082aebc0c0525e795d3e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618708, "uuid": "4a9e0ae8-71d8-410e-a897-75509998b4b3", "comment": "Malware payload", "value": "e1478927a9f2ca55bc5016dcd4293cd38d3cbc5a", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618708, "uuid": "cbdddf73-5fcd-4579-961b-8cea56e9f027", "comment": "Malware payload", "value": "b84b6a55260a22b3b4a86ff3b91844d25f2e848be1a399feaace4668fdad6ea1bfd8dbf145e73321ac91329d99deeed3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618708, "uuid": "981d9c64-d6c3-4b64-bc41-d4e1356f1f7c", "value": "T195A4F1A1F4A1EA0BDB870F39DBD3D1E14611FDA29E2A4A0B6645731E1EF35506D03E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618708, "uuid": "5e5fed0f-bef9-4aa1-b42c-61aa9c729855", "value": "6144:ippZ+RwPONXoRjZ7SezmfDlavx+W/WGW3i9BxfQvUNNtnJQkrLE+gTzTpZBjdtEI:ipii9PQvUJRZ0UdjVWeWfcznshR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781618708, "uuid": "467f2514-4728-4ad6-ade1-aaf330b40c3c", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781618708, "uuid": "23a5f438-8c4c-4036-b7e1-2459713198d2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618708, "uuid": "7e036554-badf-45f3-9680-db3c3de5556f", "value": "PO 142600142~144.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805f2c15-6980-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781613605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613605, "uuid": "9faa5511-2071-4e3c-9fcc-0acbc6017b37", "comment": "Malware payload (PureLogsStealer)", "value": "b9aacecc91b08e17444507e3e9b98028", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613605, "uuid": "37b5bb6a-493a-4d8d-8c18-f632202d049d", "comment": "Malware payload (PureLogsStealer)", "value": "700bbe8a6f8d93252ba474406f233d41e3fe702c33ef0563f25abba14192424d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613605, "uuid": "3d9066a9-ae62-49c7-89ac-29a155301054", "comment": "Malware payload (PureLogsStealer)", "value": "05b3a71929b54a99f9a17f477bf4c4e4c5f59c6e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613605, "uuid": "c5d7b845-3406-4bb1-a178-ced7a9874a22", "comment": "Malware payload (PureLogsStealer)", "value": "463421e4d92bf67eee71ce4eda02e356879aa4ecd5feb997e03479882562240a121359f8036b00b506f506200e041f39", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613605, "uuid": "18aba124-7ab2-4bc4-8be7-a021a4fcd200", "value": "T12423A63EFEF3C7924D837AC5EA466A6850925C066AEE4A66B0CD44C70F053394E295CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613605, "uuid": "a4b26570-f067-4112-a2ea-c96d7a763b26", "value": "768:YStuTJ+ap+p/papCpVpapxpDp3pKvz6d+:v6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781613605, "uuid": "ae5f4bef-b26a-4bb5-9517-5e1a187dee4f", "value": 48206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781613605, "uuid": "2e7cf457-5c87-4dbd-adcd-4b15b5754f93", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613605, "uuid": "9cf99fd5-8b65-467b-9efc-52c57793bbab", "value": "bestwishesfromthebetterplacescomingforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52de701-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608540, "uuid": "d7206cc6-0c5a-4ad7-bff4-88f7ac8e7f90", "comment": "Malware payload (Mirai)", "value": "251936d9ec2f4871290d3d888df6e53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608540, "uuid": "967749e8-8c32-43a9-b77e-3a643f4e49c6", "comment": "Malware payload (Mirai)", "value": "71302bfae1aad15caaec0b1d92c56b12fc279becb575b21e4c7f16e763b3c10c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608540, "uuid": "555fcc8e-a9e4-4bc1-853d-75daff1f32e0", "comment": "Malware payload (Mirai)", "value": "40eba30e9c70a8f52fed5cffe0d695d12e0ef503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608540, "uuid": "7486377a-bd2f-4d04-85d9-e93d083ce58b", "comment": "Malware payload (Mirai)", "value": "aa00956feb68aad53041736bb5a055e8205be2ea722b257785c2de949e8f20128531a1ea00fdfef2cd05974ad99dd178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608540, "uuid": "5fbf5e8b-896d-4856-899c-d44984bd5abe", "value": "T1208464379A254DA7E4158CB3126732425C4E87BB84EA2BE3FA668954FF2580F41F7DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608540, "uuid": "39cad76b-884f-4369-a63a-1df1ce422017", "value": "6144:HkYCK4/jZ2wjoWOUOmk/mrjhTJfjUHcMNb:fCXZ2wjVO5/mrjhTJfjUHcMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608540, "uuid": "b38c656e-18a5-4c5d-a9eb-946943450201", "value": 390453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608540, "uuid": "8afd1590-b9ab-4bff-ace4-ee2de999b563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608540, "uuid": "a36819a8-b65f-46db-acde-c2658f37c834", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f96521-6967-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781602843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602843, "uuid": "1a8ec315-68ea-48f5-945c-4a1e263a9051", "comment": "Malware payload (Kimsuky)", "value": "f2f1db11c818df7e50673c1c325edee0", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602843, "uuid": "16e50de8-92ed-459e-a381-ec26de05830f", "comment": "Malware payload (Kimsuky)", "value": "71799f7d5a277c23fd4fc97a8c0a03ad0d4c4596466564464217c3353542987a", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602843, "uuid": "6972e6b8-3349-4865-8a60-9a25a55935ee", "comment": "Malware payload (Kimsuky)", "value": "72591c27d9f948e35b43ae3147e96dfa61072767", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602843, "uuid": "05d19908-6784-41b2-a105-1ce92640bc78", "comment": "Malware payload (Kimsuky)", "value": "90406c19a4659d1d22bfb1dbd445a7bb1fdc3227717ac052e417708a1b3cf9eb94c246e9f46ad023d1bbb5be68b56ed6", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602843, "uuid": "ccb90b00-8486-4567-91f7-b1ee8b2adbb0", "value": "T13E35338321D1B616EB02ED60AD0A7E73DDBDA71998B3E81A0BD4F5D207FC06252165CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602843, "uuid": "16db0ac4-ea9f-4b37-b06a-d6832f554092", "value": "24576:pl6GckrOLY8ZcALgxrF3Eb9qohh4B/WSWmD1cpWwALFopheo:pl6TLgxrlEb9VhhqWi0Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781602843, "uuid": "1c7422ec-715d-4134-92e3-f37affc8286b", "value": 1153094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781602843, "uuid": "b0a3a6b3-d086-45ed-bd38-db79f9601869", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602843, "uuid": "bab31202-4033-4b0d-a3fc-ea3dce2cdc33", "value": "bafybeignlz4bxmlpwju3guikjack4cfdd2xvqpdoh63kywlnwetaplqfdu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88856f8f-69bc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781639389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781639389, "uuid": "4c7a41e1-5b66-4b2d-b4cd-786064c6bd0a", "comment": "Malware payload (RemusStealer)", "value": "0bb18e2cdcd593bcad15bae3a506256a", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781639389, "uuid": "ab004eea-2e57-4b3d-9275-7a19a6db9356", "comment": "Malware payload (RemusStealer)", "value": "71cba217e9878542c95b8fee784bba83a6d4cc9c0e1d8aaccf7186f742e3fc36", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781639389, "uuid": "c5833ee9-508a-4f84-82ba-0cf3f01ba38d", "comment": "Malware payload (RemusStealer)", "value": "bd2782ac3fc8d64238ca407075dcfffe164acb61", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781639389, "uuid": "12b33fbc-e1b5-4185-b650-a3bee2279f07", "comment": "Malware payload (RemusStealer)", "value": "0f7f4e94d85d048d33089e060355787a378b9cf84d37aeab1611e5f05cc2f495d2e74be382536f0eef94be4f49c5909f", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781639389, "uuid": "9b609a79-a79a-4522-8ac8-f55f1f808f1a", "value": "T177243967D26371FCD652C07852667232FB33BA7943349DF70292C7319E22AC0AE79925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781639389, "uuid": "2e721a86-aeb9-4a56-9883-f07e99920ac7", "value": "17081ce96f78327d576e14ddd5592fba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781639389, "uuid": "f835e158-9e17-4096-a4d8-6dfc742608f7", "value": "3072:KnlM9AEUZlahswkWnOX6Z0NTP7Az9r0EpPzv009BGL+FV9UEHA:7H69Sa6jz9r0ElFjhVZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781639389, "uuid": "16c40cf3-3fd8-468f-843e-1646c8644f44", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781639389, "uuid": "52384ddf-d4ac-447e-baa9-ce70a35c9da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781639389, "uuid": "4c18cbb2-02a9-4b1f-b5e7-eac12c8e7ee3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2b14df-695d-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1781598428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781598428, "uuid": "b8103561-e5ea-49d6-a182-dcb7d9fb2502", "comment": "Malware payload (PureHVNC)", "value": "80bc9159d86170586359786371b1adeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781598428, "uuid": "6fffbdff-e048-425a-88dc-886111a489d3", "comment": "Malware payload (PureHVNC)", "value": "72d9bc04b1dfdaffc927886217386e272798a62fb7c5e54e0c4fec1c6658bfaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781598428, "uuid": "ad0ec095-aa2e-48a7-8a13-bc6efde75533", "comment": "Malware payload (PureHVNC)", "value": "61d3e96646fba63e999cf52e1843c2668d8558ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781598428, "uuid": "fb4f228c-a054-48dd-950f-50cbb8d01fd4", "comment": "Malware payload (PureHVNC)", "value": "0a908c98242d428847d368b876a1ca28a2d8f1e4d66e2315844f29afa252a95d2ea80fe664c6c5ef468713549b90bb53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781598428, "uuid": "b0d82df5-f6a1-4d57-b788-1176539a68fd", "value": "T176F4BE0B32568E21D2840232C1E7550187F5A54B7A77E70F3A84239B2E427FBEE4B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781598428, "uuid": "c2b75927-876b-42e1-9de1-731a7c067a8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781598428, "uuid": "85b120e6-4bae-4baa-b19a-e878966e97e8", "value": "12288:DZVUVfJXMxlln5IpQR/4FrVlaVw/FSJuL28UWXMB1WC2iYrxY4nsZ:twJXMxlln5IpQROPvwuL28FXMEbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781598428, "uuid": "3f41ca26-08ea-4f4c-99a3-64944e77711e", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781598428, "uuid": "c3b3c5da-dd05-43b3-80de-c4a7e67d555f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781598428, "uuid": "e4706330-3bf2-402c-979c-1145e7f516de", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.28575937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddfc6bd-697c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781611749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611749, "uuid": "1b9b7b05-547e-4667-aad0-0555ddc58e44", "comment": "Malware payload (PureLogsStealer)", "value": "5816148781b05c5b68ebc2f7091cd281", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611749, "uuid": "bdeb4e9b-fbf2-447f-bf1f-3c6571d6d8fb", "comment": "Malware payload (PureLogsStealer)", "value": "733cb766ed12dc9779db0dd699275f329d3a7783e8db94edb740804f82e9b26c", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611749, "uuid": "1e0bddcd-0553-466b-956e-738b5813e093", "comment": "Malware payload (PureLogsStealer)", "value": "e263e3776bf3dd8fd44f6de73e21685e854f1f2c", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611749, "uuid": "eaececd6-4fe9-4ecf-999c-52d9b0e64a9a", "comment": "Malware payload (PureLogsStealer)", "value": "955d92c3c30bafc7759a176c691f27e0f0c9876fa9d79b9b91639522b71c71d8d777fb2530e50d727b4b52f002a3d68a", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611749, "uuid": "af6a0810-087a-43a9-b5f2-682627e97197", "value": "T16ED40191F5A4990ADFAB0F78C7C386E25611FCA15D964A0F7250336E2EF37A16D03D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611749, "uuid": "72f217fc-a4ea-499f-92d1-25dbf8ff5db2", "value": "12288:aLH4jiii9PQvUJNde6Y15gSkAL5alwy7W:aLHiiP94vUNe6k5gSj5alw4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611749, "uuid": "71e0413a-c75c-4979-98bb-800024926ba9", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611749, "uuid": "b673c824-4cbf-4877-80cc-44443a3d4fe8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611749, "uuid": "1e43898d-e4e9-4d28-b93c-6a68f6af9a03", "value": "SHIPMENT DOCUMENTS-4500172757.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5cf138-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781607501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607501, "uuid": "5ee20ab2-499d-49dd-8e52-3c57cb7a4d5b", "comment": "Malware payload (Kimsuky)", "value": "11a0bd62dce4b99c84528d1139aec486", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607501, "uuid": "64eb6afd-c9f0-4982-8b89-7174da590207", "comment": "Malware payload (Kimsuky)", "value": "76754a9ee2f2b9d3aaed83e7366e8f74845a2068e3f653654d78bb502a3d4520", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607501, "uuid": "0d7dea3b-4fbc-492b-a094-5b3bb0e5d37b", "comment": "Malware payload (Kimsuky)", "value": "b637a5ca385bea8e74fc1e16a2e1b16ac3dcd650", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607501, "uuid": "aa163edd-d13f-4a08-be65-152f7a8aed5a", "comment": "Malware payload (Kimsuky)", "value": "66802de2e57fdc8176aeee0e29cb1ce88c2e212157fcd3ebcd3b25a085f4d4e3168004b56460b185306e3a9a0c473837", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607501, "uuid": "49133f8c-3770-47e9-ab2c-1a52e08faabd", "value": "T16003C8578505C7CA3BA062AB27DBE5873604CC6E00E5CF86F57FCD3AA3048097668B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607501, "uuid": "df6a86a2-2d2a-4849-a987-c4aae71824c1", "value": "768:6VHfcsgXJeB6jl73BkohRw2Rx+JgmxP3/CiK0IVS3t0jEPtztYZsO29LDespMbv1:l3BXw2Rx+JgmxJK0Iq4KcYy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607501, "uuid": "f0adfa6e-7be4-4308-9a9e-a8c50578b55f", "value": 38069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607501, "uuid": "b29cd1b3-7598-4a4c-8388-ddce00b6245a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607501, "uuid": "7a588b10-33a4-4688-89c1-25200ae46bde", "value": "wrkxaqww.o4g.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929bcdc9-6983-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781614924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781614924, "uuid": "7aecd830-318a-40f9-b5a2-6bd28ad06d4e", "comment": "Malware payload", "value": "4f83c9e4af12ca0341fd11f92dd65eea", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781614924, "uuid": "a092bb25-7fbf-47d3-b2d3-a68fc089014f", "comment": "Malware payload", "value": "768673c2287c93df6e5e196c78ec7537573944c051ab46ca1fcedd2539867134", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781614924, "uuid": "e9ac4b9c-4753-447c-8165-a827f3122d4d", "comment": "Malware payload", "value": "69ea4fbe775e5425dbe8aa81aa3d67485a920e57", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781614924, "uuid": "2bfb1636-35f8-458d-a299-af1e9bd80e58", "comment": "Malware payload", "value": "0eaed02ff827f8f7c649a082f217e5ccae723a014dfdf4e146e39e36bc70581acac52ea966ccc7bab4bccd71fa4dda37", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781614924, "uuid": "294c0a97-c25f-4fe5-b576-1f7cf5b81b84", "value": "T1AE1833245F948CD6F55231399A916244E3F3BA6817B18B9E0BC06B212E375FBEC3D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781614924, "uuid": "f62e264e-8ec2-4567-8282-4c19b815fbe3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781614924, "uuid": "726161d8-e38e-44fe-83bc-f86168525a04", "value": "1572864:wAYyyxBU7rUFpYSHK8o8iLxMtQ6ZMo/STJ6ppJ2FNwW5wF:wfxgkaUc4R/U6pXoQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781614924, "uuid": "e0a1aaaa-c593-4250-8513-6cff68736f6a", "value": 85020275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781614924, "uuid": "735d8109-b0f6-4c92-b441-e3dc67434bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781614924, "uuid": "14ebdfd4-a7ff-4e9c-92d6-e187cda62bd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8595c6d7-69bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781638954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781638954, "uuid": "3432e041-a888-44dd-a385-1651a70ad5a7", "comment": "Malware payload", "value": "ff1e1cd1779e62d3ed843d567414f3b4", "object_relation": "md5", "Tag": [ { "name": "kelkel-rmtdelek-digital", "colour": "#E117F4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781638954, "uuid": "12df9fc3-739a-4411-b2a3-b69d401f421f", "comment": "Malware payload", "value": "76ccd85ab8f28058a926eb8d2ea07dd7572896046dd1ae742ec453e1da9213e4", "object_relation": "sha256", "Tag": [ { "name": "kelkel-rmtdelek-digital", "colour": "#E117F4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781638954, "uuid": "8f5fb150-b96e-4c2d-ba56-7bebe87edbd4", "comment": "Malware payload", "value": "a36d8c8cabf68c9e29834d662e490655006808b0", "object_relation": "sha1", "Tag": [ { "name": "kelkel-rmtdelek-digital", "colour": "#E117F4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781638954, "uuid": "1c320340-ec86-42a4-8b5e-5d5381637c35", "comment": "Malware payload", "value": "78e8445a2c00afd2223e82ce252d8b52e82ec1b3c0ccaa9a56663bf6ba1817d51ce2279bdc10a7d8c0ec5a8637bd5213", "object_relation": "sha3-384", "Tag": [ { "name": "kelkel-rmtdelek-digital", "colour": "#E117F4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781638954, "uuid": "26983d73-ca71-4a5b-879c-d3b2075a938a", "value": "T1763633276CCA2E7EC22C95748675952C01062D123F0EA593A68E7B8D37BB37193DD34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781638954, "uuid": "fdccdcaf-9276-4cbb-92aa-6cdc12429754", "value": "98304:p9VCx+s9WecPr0eLAoroqOPudGSJuxkSVRO4ky7G6lZ3QEZUtQLQTqI4y+LnUSwH:p9VCosyhAoroqTdGSyVR+y7dlrkVTqIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781638954, "uuid": "860ab314-d274-45c5-9e5c-c65bd39e785e", "value": 5336576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781638954, "uuid": "b4a864b4-7222-4fd4-8d48-643118dc0008", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781638954, "uuid": "41a91f71-a938-406d-b117-93554861797e", "value": "WebViewRuntime.msi.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc917029-6996-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781623155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623155, "uuid": "d66bad01-1fca-4fcb-a626-3717034234ec", "comment": "Malware payload", "value": "a0f29efb477397cad3e13a381c88c487", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623155, "uuid": "bbae7c33-f122-4724-86c7-504bdcbd8a78", "comment": "Malware payload", "value": "77956fd48a5a4d6d34eeb07cfdb8aacf5a43e1d8aec57af1f955c2c7595bb60f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623155, "uuid": "a23ed664-0552-4c54-9415-d38b40aa7dc1", "comment": "Malware payload", "value": "67cce8ca7c398e094512d4301ee4569a3405f54a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623155, "uuid": "3bc5cb93-03d7-4569-b65a-ffa37646231d", "comment": "Malware payload", "value": "14475395640e4d819dfff84d6ffbdb2fc6a08e368a93ac441000e4b2a19ac449372b6ffdb10cbeb4bd19132dbe3f1258", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623155, "uuid": "8382cf69-514f-42f6-9458-ea6f7e2dcaac", "value": "T147E092F818304FCE930D4985727604EA51155D9AAFEB0EDDE2812FFD106E496FC4BB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623155, "uuid": "9b02bc8a-38ef-41f9-ad57-51fa904e1874", "value": "12:YO92J9tLmgVHxcxgVHx9HCY9dRIgVHxWgVHxJ6n:YO92J9tLFrjrUY9dRzrVrMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623155, "uuid": "37eb4408-1028-4eb0-9f8d-8bfc509111e9", "value": 397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623155, "uuid": "7e7d38f6-5d17-42cf-8315-0026a34c386d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623155, "uuid": "f9c1bbbb-6557-4ebf-b3b9-9661175bda3e", "value": "auto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ef82d2-693e-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1781585157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781585157, "uuid": "eb1ce21e-4f9b-4b90-b1fc-19bbe4e7773f", "comment": "Malware payload (Stealc)", "value": "d4ad96166ed5242fdc71764416df824d", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781585157, "uuid": "03743b41-16b6-4ddf-9bde-a0f90a6c0c78", "comment": "Malware payload (Stealc)", "value": "787b287a86e8b3cb0f84ea80115ef5e87cee33f13b418e98e32b4335fdcd63eb", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781585157, "uuid": "28d72e1a-02f1-4a4b-aa27-c8d3e8327019", "comment": "Malware payload (Stealc)", "value": "3860f7ea0c5165c94b5f0e432abb2142f7a7ff32", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781585157, "uuid": "85ab6859-52a7-41f1-8a4f-6708a8732b45", "comment": "Malware payload (Stealc)", "value": "db6881911cd2843a8753aec623cd005b619021269f5c4071f1e06010ff208e9037bdb4eabe8e1f3525ef0037d503ce53", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781585157, "uuid": "eef5e41d-80dd-4017-a3be-9477738760c9", "value": "T15865381BBCA505F6D4AA5332887661917BB1BC890F3223D72EA0B27C2F767E49D75304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781585157, "uuid": "aa273ae8-abaa-4f45-ab92-a896ed0029c0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781585157, "uuid": "96037118-5912-4419-8721-2dd310d182bc", "value": "24576:mXrbpndKCnXm8RNmgM8u+Fdf6/NBele5yKD9eX5yiM:mfxdKkXmAmCu+p2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781585157, "uuid": "40c136f4-b3bb-4ef4-b7d8-aad234cfa950", "value": 1534464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781585157, "uuid": "011031ff-6fea-484d-89d7-085d31dd697b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781585157, "uuid": "c8c659e6-8511-46f2-8c5a-b6012dcfd2ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7265fc2-696f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781606396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606396, "uuid": "1407d4c4-92ec-40c4-a2b9-a967c9a67957", "comment": "Malware payload", "value": "3ee51597372e6fe69a1fd148b2cd0c1e", "object_relation": "md5", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606396, "uuid": "3127e048-a91a-4921-803f-77ebeca961f8", "comment": "Malware payload", "value": "789c786f5a7b797c177515c9a5d29b29eb86c8a1d5c5e7181cb00b821cdbb7f3", "object_relation": "sha256", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606396, "uuid": "ed78a5d9-d596-467b-8af0-5110afc0ad2d", "comment": "Malware payload", "value": "dd8ecae5aaca646afe57aedad2afb16de8ed617b", "object_relation": "sha1", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606396, "uuid": "552f9de9-2cc3-4fca-9d3c-43090a2d6737", "comment": "Malware payload", "value": "7dbbafc4992a24f1fb4e1997f7c93716885c1633da26bdbad68318569bc2b748f534c49f84efd3be1614f8bfb4c62cb0", "object_relation": "sha3-384", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606396, "uuid": "cb3cd3e2-29fd-4430-b20e-fad86d4931c5", "value": "T1C756C013B299253EE87B1A36483F9754983B7EA126924C0797F42A4CCF7E5401D3AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606396, "uuid": "0e51f3ae-b05e-4c35-b68c-02a4eb4f49a6", "value": "ebf9f50934ebfc138912ce0c5847005a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606396, "uuid": "80f524d3-82ce-413c-a701-6acdedd23920", "value": "98304:lIS6/e7gju6UY3Q0YPEgRHTsm+MCvkBpeq/3F:uSwUY3Q0YPppsm+MCMfeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606396, "uuid": "4731fc86-d43f-4732-9ce8-fe4bd3fee2f9", "value": 6067728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606396, "uuid": "6750d816-b0dd-49b4-b5c1-fe0b273879e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606396, "uuid": "6b8246a8-97b5-492e-8b52-e3633d1a1a19", "value": "789c786f5a7b797c177515c9a5d29b29eb86c8a1d5c5e7181cb00b821cdbb7f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0071785-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605525, "uuid": "18676481-323b-48d6-a308-f9ddda8b3a7b", "comment": "Malware payload", "value": "8bb5d3fe00c0f09123fa2994af906069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605525, "uuid": "158d1f1d-0307-4dea-8ab9-60a10f7ec4f2", "comment": "Malware payload", "value": "78f702d92884300dae4537bff4a3b97b97154e55cb3fa86187466751e2da31f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605525, "uuid": "c8c8e40f-d1e3-40d4-a6f6-3bcc75f6324f", "comment": "Malware payload", "value": "1483b3ce795f7fa575c51e83e3ec5c2965002f5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605525, "uuid": "c91cd200-a3a6-40c3-8c08-aaa9644c9b98", "comment": "Malware payload", "value": "00ee2c4720666802e3acf268bff4084f749961bd8e1d05ff364fc89d5d0e7057f001ce46e7f10e00ba18a75baff032a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605525, "uuid": "f6bf9803-583a-492e-be58-261394b2ba53", "value": "T17A769F03FC921D7AE1279238C4A650A36F987C46AF5102F769B8F3E829B76F0157DB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605525, "uuid": "4c31536a-f94c-47ae-b567-301a9ac9e2d2", "value": "d203f9672085bd7924a65988545977e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605525, "uuid": "19006c19-f721-4427-a01b-638ec40bef46", "value": "49152:2yadDYcMuXZv0sIgZY5P+Nv9NDiTV73BxqCa/Xhthe1ju:2jomNv/iB7RYCaeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605525, "uuid": "11b879df-cc7b-4bb7-a017-491ebece0c98", "value": 7789520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605525, "uuid": "55da5970-1baa-4701-8ba3-83b3ac3cfe24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605525, "uuid": "f626658e-a58a-4b05-b6a4-8f5480f4105f", "value": "78f702d92884300dae4537bff4a3b97b97154e55cb3fa86187466751e2da31f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fea167-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623043, "uuid": "d27a6680-a98b-4e05-96c2-a86cdb1940c7", "comment": "Malware payload (Mirai)", "value": "b9f0209f601015691ec0c28909192f35", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623043, "uuid": "5b8c48cb-087f-4dcf-b35c-17ce0ca8d401", "comment": "Malware payload (Mirai)", "value": "7923f0433e4d3d1a501fc29427eb3a93c343e83808dc3ad7bf5eeca296cb464e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623043, "uuid": "5a6b00b4-a70b-4f63-88e7-161053a40b49", "comment": "Malware payload (Mirai)", "value": "b75de8e9b320554f45be38db84bd65448bfc2e2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623043, "uuid": "02fee230-009c-49bb-b617-0e6cc4bf7b61", "comment": "Malware payload (Mirai)", "value": "999878819ab88b2e603d7ef1f73dc634481186c503fd4dee3a498a9737185c2700b00187a90db763b8ff90b8181f96a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623043, "uuid": "925e038c-2920-4df2-9333-a14ad8a9862d", "value": "T1474102CA1F329EF9F056D53C47370B3A27AA560843D18249E1ACDA002EC030D85DE6E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623043, "uuid": "96f2a90a-1600-4187-8636-80f6f86ce39e", "value": "24:3+mkMdb5jl8AmslI3t8AmypR/z2Hx7llPgYWB4u3GbI8paLdz3N9l5zBkEp7iwpK:Omr5E4GYg2Hn+heML/9LuEpjn3P9aBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623043, "uuid": "281b3731-0d01-430f-9ed8-8e7a1c121c72", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623043, "uuid": "bd210be6-5f82-4773-b9d1-8f236c496f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623043, "uuid": "92c67caf-36b7-4f0a-aeab-db29841d5ab5", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b57f515-69c1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781641514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641514, "uuid": "8ba264fc-e203-4efe-b7ed-20d7b89f3f25", "comment": "Malware payload (Mirai)", "value": "5b8c7a667e635000d00ba5a5ca44521b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641514, "uuid": "caba1198-a18f-422b-8ce9-d58e9e77cab5", "comment": "Malware payload (Mirai)", "value": "792ca1b4795e08db736ca9dbca283ae481baeadd08defc85a7e4dd59995c146e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641514, "uuid": "bd0fc683-af00-44f7-af8b-63866c6fc7e4", "comment": "Malware payload (Mirai)", "value": "d1c8f596f6c2b18cd91423401ac9c42a0fe54572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641514, "uuid": "e501ecd3-8a73-475b-b560-24341f8636be", "comment": "Malware payload (Mirai)", "value": "0b95ee8e6064b25cf29928bda407138ffa61b9acfcc6e00c37d35a5fa1d396f6e28cbeca94949fd2600b208981800684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641514, "uuid": "9c14093f-ca98-4210-a36c-9700ae2c7456", "value": "T1FF830270616E0FFF8A50227DC139478E69E7A599C0FD31A9B075612FB9420981FEF2C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641514, "uuid": "771f4f53-5c8f-42a0-9587-607ce835d6cc", "value": "1536:gk8q6ZvW9deYNbIIPWctE0QY7SE4L2XRAeN/vJUTDQy3mYSEyP5qPaLR:gcevWH1RHtE0Qr+RAeN3uPQy3mz5rLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781641514, "uuid": "be7f09e2-789d-41cc-ae2c-0ab530e05e92", "value": 84188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781641514, "uuid": "609e17c6-2bd1-4748-b9b3-490c3b066062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641514, "uuid": "3463871a-6f76-45e2-96bf-12c2dce17233", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17a7aa1-6969-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781603863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603863, "uuid": "e3c46b08-f448-4ed0-9372-6b3274794248", "comment": "Malware payload (ConnectWise)", "value": "af08bec973fdd3d7984edcadb24f3d42", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603863, "uuid": "31e2a70f-3995-4878-977f-10b0f0160b46", "comment": "Malware payload (ConnectWise)", "value": "7aaee368f19c7282c7f29ed7e7e236afbafdbd2264bd263ee7a03afd05a47e43", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603863, "uuid": "27f8a2c1-0885-44c5-b77e-54269930c90c", "comment": "Malware payload (ConnectWise)", "value": "b68ad50cf0875dbded123d91f189275764a0b948", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603863, "uuid": "fdac455e-0e3c-4b11-a95c-693cf7527d82", "comment": "Malware payload (ConnectWise)", "value": "4a5e11fcad4bcfab03bf0314de72951734fd15312056f07871f643aca27cb9b67929922b179aa34d22a8dc5982a5e7c9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603863, "uuid": "4c57a81d-8779-4c44-9efe-58e5f0fcff48", "value": "T1D946F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603863, "uuid": "46255ff8-bb4d-4fa6-a83f-b493d7ba728c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603863, "uuid": "8fa983ac-d5a1-4165-99f7-250a66b3936e", "value": "49152:VfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:mrs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603863, "uuid": "c2e4a923-bfee-47e8-94bf-dc557e80c6d5", "value": 5647544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603863, "uuid": "8224d710-857b-416c-a584-a986f06efbde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603863, "uuid": "c42aff41-8b27-4cd9-8423-489a44195c6b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afab805-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781650425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650425, "uuid": "d66a72b1-d230-496d-827f-12c931d009d1", "comment": "Malware payload (Mirai)", "value": "d8b5940d8931a7fb6c85a79d8a206fdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650425, "uuid": "2c1c069d-9998-4e0d-871b-cbe13ac74f86", "comment": "Malware payload (Mirai)", "value": "7afdc34246b24c76c8fd418d9ecaa6275f2e0fc6e235886407593b043447c1f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650425, "uuid": "bc8bb809-18ae-41a1-a5a9-4ebb79afb0ae", "comment": "Malware payload (Mirai)", "value": "46d18e4e3def54e46b7cd4ce1c4827496b458699", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650425, "uuid": "2cc20f17-5e2e-445d-95b4-4554c0045ed1", "comment": "Malware payload (Mirai)", "value": "4f91ecc56ad1ca14fb94c083225897440c99ad8e64a29af8af69d30a9c98eaa205fe442641e6b41a7f42a979cab6c961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650425, "uuid": "c687bc6f-259e-4c20-ab26-38f3687d2793", "value": "T119C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB367574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650425, "uuid": "d3964e58-4644-4eae-84bf-4a672647d743", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMtN:MwCvdHmezn0nUPMu9KryXsMtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650425, "uuid": "84d8fe85-7475-44f9-ab04-567ced402aca", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650425, "uuid": "0bce8fa1-d5b4-4e2c-b0d4-bb20a1228c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650425, "uuid": "fe64c098-9271-46f8-ab20-1ec25998291c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67a3217-698f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781620165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620165, "uuid": "e29c6d12-6704-4730-bf26-ce929913dcd9", "comment": "Malware payload (Mirai)", "value": "7a1b9d16e70aaad5828f75887d232cae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620165, "uuid": "8c620c8a-f9cb-4d2b-9b98-5a3085ed1662", "comment": "Malware payload (Mirai)", "value": "7b06d15559d7eeef4cdb8317a1e88c6dc40a122dc83dd29cb1bb9320235bae40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620165, "uuid": "4b1c7240-e55e-4424-910b-e0ea0f758b07", "comment": "Malware payload (Mirai)", "value": "2f18a99f2d6662e3d8128f8d25eb69986657ec46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620165, "uuid": "9d0025bf-fa7b-4e4b-b9ea-9ea15c82dc48", "comment": "Malware payload (Mirai)", "value": "ab5e1165b76ae8d83ea6254c413ff56f2e1e6e39d7f627371ea09b21151bb522d06774339af71f2de606ff152728d756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620165, "uuid": "400b311e-2c85-4886-a26d-718e40601ef0", "value": "T11083C506AA419F01D59731FAFB8F425573936FACE3F97101D924AF6123C6ADB0F62212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620165, "uuid": "e44956c9-f30a-41bd-8f0e-d627d6a75104", "value": "1536:EInT5MLtAKijVu/hpjvrajk7hbdlZZVT0lDDcki6+KniPYcZJAVxWR:CZlgc/hpjvrajk7hbdHw+KniPVJAVxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620165, "uuid": "b9418932-642d-48fc-b306-f48446ac538d", "value": 83036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620165, "uuid": "a89b2c8e-735a-4889-8bef-83f738bef65e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620165, "uuid": "9b758e18-ac1e-4dd2-ae32-45f98b184da9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12a6d0a-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609016, "uuid": "746c3553-a3af-4496-8751-6388b4d3cfd9", "comment": "Malware payload (Kimsuky)", "value": "7f3ccb6d55ff6dd3adc80cb29937bc18", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609016, "uuid": "58873399-1718-4efd-b46e-2e22c91be25a", "comment": "Malware payload (Kimsuky)", "value": "7c29e0aa41f25a12434fc124e30e751b4af0f35167e96cb401716c10e9fbccce", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609016, "uuid": "0192096b-0283-4033-9f7e-26be921f085e", "comment": "Malware payload (Kimsuky)", "value": "a902834d22331a42137d30296b20bbb44e863f8a", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609016, "uuid": "7b9d04b5-c640-4e5f-ba5d-f0eb34b3aeff", "comment": "Malware payload (Kimsuky)", "value": "997dc08cb67ee0edc412ca1e9cbde5fdf0ffb0aa40db1a77583d8769199764bc3c2ed3aa1822cadfc53c0c3ff1ce39d2", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609016, "uuid": "9aa1a8ff-a384-4db4-9b09-df8c0f26be0a", "value": "T1CD03C99B5519C7863B6022FB2BEBA5D73604CCA900E5CF86F5BECD3A6301C197264B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609016, "uuid": "6d0d9bc9-a068-43fc-8c67-30a4118da671", "value": "768:gG94J0DLa63G97kshBkohRw2Rx+Jgmx0+oN0gaVOIH6NEopWiv5Pf8VjkRkovOrl:3shBXw2Rx+Jgmx0+oNEH6NEdM9Obg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609016, "uuid": "a86e3f6e-c29a-4734-8e34-b6ffff2cc315", "value": 40070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609016, "uuid": "fdf9066c-bb2f-422e-b8fa-ff5f2b33be99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609016, "uuid": "d5678f98-f094-4b03-8358-f98bc3ac2889", "value": "7c29e0aa41f25a12434fc124e30e751b4af0f35167e96cb401716c10e9fbccce.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c5bdf7-6977-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781609566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609566, "uuid": "8a7b048a-d610-449c-a2c6-c120d79bae99", "comment": "Malware payload (Vidar)", "value": "aba6be1e3490f6e7e8bff08e8c63a63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609566, "uuid": "54213e78-0c81-46ea-88f1-b26f2c062c3f", "comment": "Malware payload (Vidar)", "value": "7c31714b869453bd2e9f0e6506b1feb095b743fa191911b3115be14875f430e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609566, "uuid": "acff2b7d-1c5e-44fc-bf0d-fa463ff18101", "comment": "Malware payload (Vidar)", "value": "d1e31973ba774b463150c869dc8fc9194b463e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609566, "uuid": "3d49d943-b7a2-4277-be02-852e85bf1fa3", "comment": "Malware payload (Vidar)", "value": "106e0de2a43964564eb02adf87767f7501c1691c700384370418d3d24a052e6c45a18f4aa5e5d9128480b700d2be3b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609566, "uuid": "6007008e-d20a-41ec-a202-f1ed16d610cc", "value": "T13B068C07EC904976C4AAA33248A786427B3DFC441B7627D31E60B67A7FB6BD06C76344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609566, "uuid": "d39abee5-fd8b-4b3e-bc9c-83c533954004", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609566, "uuid": "6bb6add6-65a3-4b68-bd5b-de4c25f400a8", "value": "49152:YWZs+JiFwkhwjc1pdaelhu4bM5/ip0UQBPAMx2T/nf53tDfLVwwtoCGQJv4KdfB+:YgJIpsE5b/p0UQBPA5/B3p1VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609566, "uuid": "906e017b-c529-4028-b185-d4da004fc3cb", "value": 3780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609566, "uuid": "32319eff-c0d4-4e01-9ea2-d9366ef81bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609566, "uuid": "ac8ea01a-788b-4c3c-9f39-07036bba74c6", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a01c74-6996-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781623122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623122, "uuid": "18c5d216-25ab-40a3-99cc-bd6d022a6b5f", "comment": "Malware payload", "value": "7551cf6a6d8cff8fab7865737f7563ea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623122, "uuid": "947c3231-1ae4-44e3-b15e-985641ea3dcb", "comment": "Malware payload", "value": "7c45ee3bc05dd0e1ea8254600adb490dffaa7ea65105f5c59387e75210ea0da9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623122, "uuid": "a7c9ba9b-52ff-4566-a0ec-36bd1fb2cb0d", "comment": "Malware payload", "value": "dd0e01cae9f88d1492d035d95f388e2c7ba96a1d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623122, "uuid": "29b128d1-f8af-4ad9-ba90-66fac6524c68", "comment": "Malware payload", "value": "e66ab706473f5a9816da0903dff7de3007867a7cfd2eee0bf1887c1ded1b05fa71d1769c8cd1b1ee76cddd3c64d98032", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623122, "uuid": "b3e0dbea-f20c-4dfb-b6a5-412e5e0462dc", "value": "T15221D2825731ADB82888455DA2A7505EA083021F565F6FECB5D69BFB0F0D8C1F5D8FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623122, "uuid": "e89ffe6b-e86c-49ec-869a-777f49fe2c9e", "value": "24:VUeYj+H1TrEDMK9CFdYhEnHQBYcduuD9IdMzrirCwPrpUrpARiy3AnQZaZl1cSRc:VUeYj+H1TrEDMK9CnYhEkDqMzrirCqrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623122, "uuid": "69e5da37-4c20-41e3-a93d-8e95410e8ad8", "value": 1384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623122, "uuid": "472c395b-e33d-40a9-8566-bceb969fccac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623122, "uuid": "b8e09112-295f-4a22-96f8-0ca899a7e1aa", "value": "check1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d4586f-6953-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781594104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594104, "uuid": "0525f1ef-be2a-4b82-ae0e-fba4e90fa2d0", "comment": "Malware payload (NanoCore)", "value": "3791b58433d379c7fea76636a48aec06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594104, "uuid": "ddaf4968-395b-444b-8e70-9248f11fb923", "comment": "Malware payload (NanoCore)", "value": "7d7e966289ffed9e6b926987a1ee6503c2cf849fcea70e81ab6b46d2f32b358e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594104, "uuid": "49dfbf55-7507-45f3-9d8a-251dde961d73", "comment": "Malware payload (NanoCore)", "value": "ef5c7dd3b84717c29478f199cb6489ad68ee2fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594104, "uuid": "b700fad0-04f2-478e-b2e5-4253ad524bf8", "comment": "Malware payload (NanoCore)", "value": "b0dbcc54d46ed11edc7ee8000b211cc8b254ecf58aaf61ae8e6750341b4f66d091f2e109661c3ba54d1ae58e35bd2c1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594104, "uuid": "3c481489-d373-47ea-ab16-689bab167d6e", "value": "T13514CF5677A84A2FE2DE867D611212169379C2E39CC3F3DE28D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594104, "uuid": "9e3d3ba8-6ed7-457e-b8a5-23f2710be3b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594104, "uuid": "b3105f56-10b6-49e4-940f-68feb0908693", "value": "6144:MLV6Bta6dtJmakIM5Q6V2qhLyNPYTbEjf:MLV6BtpmkrM2uL4YTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781594104, "uuid": "e0eeb58a-1dbe-403f-b677-899a5916b0cb", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781594104, "uuid": "8eaea5f2-5e4f-4d8a-a3f8-8f998011ccd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594104, "uuid": "de6afc44-ddc2-4628-afe1-69b09c155258", "value": "3791b58433d379c7fea76636a48aec06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3043629d-6976-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609176, "uuid": "fd92ba2d-c247-44b9-a64d-aaaddacc2d29", "comment": "Malware payload (Kimsuky)", "value": "521d89f077b70a333276926d7375d9bf", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609176, "uuid": "20210276-2507-4bf3-bfd7-ddc74cc883d1", "comment": "Malware payload (Kimsuky)", "value": "7dc4e2ca3679cef003c870762e30a4615349ff41b32934df96b5b6feb65189b1", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609176, "uuid": "0743d953-7842-4381-87d5-8894d388a855", "comment": "Malware payload (Kimsuky)", "value": "c81c099aa6a4785a11958a8fce4dc72dfaea2f43", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609176, "uuid": "a5a8ae1a-eb59-421d-ba3e-9f2eac1dbb14", "comment": "Malware payload (Kimsuky)", "value": "e412c96bddcbbe0e675615d3c25a5d0500537799d2ca0e0d4724c2d950ab230869cfa7698abc0cd340ab29c16234a391", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609176, "uuid": "9bdb674f-cdd3-4a27-885f-facabc2addfc", "value": "T119B132937505C3C572C5C283BA9FE9CD7704D5B901AA8E60F8EF4A0C635AC8665B4B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609176, "uuid": "38410cae-8825-4d55-8989-f598d93952dd", "value": "96:AIAqePJszvA7JPqEaAvGzuGA195Ka2Fs3V9geCuhgK9klhgOpyCWFY+7NKePrk17:qqeCQRaAvGz2Ka2F+Yz3HgOpRWFbKePK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609176, "uuid": "21e938c4-8d62-4b2a-bd0e-8181be276840", "value": 5243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609176, "uuid": "d30672b0-1939-401c-b8d3-48806e62c420", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609176, "uuid": "d15fe26e-efe7-47ab-93ba-d6d5c77ac246", "value": "7dc4e2ca3679cef003c870762e30a4615349ff41b32934df96b5b6feb65189b1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b758e45a-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781608973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608973, "uuid": "01f91fd5-32c6-48ae-9eeb-3419b77deb62", "comment": "Malware payload (Kimsuky)", "value": "b0aca0b9e99439271c557b027260dd0e", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608973, "uuid": "5b4f37ec-b4f0-408e-85e6-1dd0a26c712c", "comment": "Malware payload (Kimsuky)", "value": "7e710504fa4823b2b65b426975ba0acdba3e56591533cc288d105222aa86b2f7", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608973, "uuid": "c3db9a79-c781-4b67-8d18-2a4d46d7db88", "comment": "Malware payload (Kimsuky)", "value": "b4f0a8a56088df15cb0920cb4e417c9b3361daf7", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608973, "uuid": "f3a0f88f-e6c1-4949-bfab-40c0df5b7fa8", "comment": "Malware payload (Kimsuky)", "value": "23cc01775de2fe194d428d80d4c64d98c6b266043cfd8e59fca44ada7fbab976fc972d575a1f2c0ad42b5210ef3b8f55", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608973, "uuid": "8651c37a-0657-4379-874c-df31b9a89e08", "value": "T17D9194E3B907C3C2F2C1924BBBEFF5983A18C66840A989A0F8DF564C6315D9D81B464D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608973, "uuid": "f1c4a510-1a4f-4691-93b7-2b0738f90b96", "value": "96:MZIAvHcccgXvSAszMTZBWA1zI2VoLT0CPN1C+4/BgOpyEHv:gfccrjZ2IaEBgOp7Hv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608973, "uuid": "afa398d7-8f35-48fe-8dac-e287d007b37d", "value": 4603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608973, "uuid": "02fbd28e-fcf3-4f0f-ba08-f31b7da9b51a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608973, "uuid": "a31ea66e-3f33-4e10-83d3-1d4f8777e5b8", "value": "7e710504fa4823b2b65b426975ba0acdba3e56591533cc288d105222aa86b2f7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6531f48-698f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781620192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620192, "uuid": "9bf2d525-9a0f-464a-a28d-179bce1572b4", "comment": "Malware payload", "value": "703165a0855852b0eccace0557c7e24b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620192, "uuid": "d5933de6-2f44-4a79-8cbb-faf5e34be836", "comment": "Malware payload", "value": "7e8693dfed67a88db885ac0ffd94b73351d1f910cafc6425e8f1b4ab0e24c2a8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620192, "uuid": "fdb07a28-1484-4f6d-b1d8-35eb5a833de1", "comment": "Malware payload", "value": "03858e66e30466445c0c4c7c80855d04ae683513", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620192, "uuid": "389910e3-b397-4fda-b50b-bd45c783d4da", "comment": "Malware payload", "value": "25342f6ea1342ab29df4aab91915fe3f7a924262c0fd01436fb67fc84b80e4eb9204c0eb4dafb03fbda157a71e12a038", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620192, "uuid": "305f2ae1-072f-4736-a0a4-f825af1a4b44", "value": "T19F762286DB29D46DC1FB5A33097742754287CC6E8B8397835DECB37825B78C06EA4B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620192, "uuid": "a03295ae-abc2-42cf-be65-322cd1d1a923", "value": "98304:KfmMc0jV+wGq38lhmPhmu9iydezO5UVwW1pwOyqnAjEagjjA+VbPRuklbVf4r2hs:Kf16Xih5QoezOtW/uqHagjR7zQr2hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620192, "uuid": "74a80ef0-e776-4b48-9f3a-ca8785c19c1c", "value": 7189793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620192, "uuid": "cfc233f6-7c6d-4011-92d1-68c9ef3fd6dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620192, "uuid": "b63c2bdc-1272-4b21-992e-632e2c7b1d98", "value": "TikTok_Mode.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12db348-6925-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781574683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781574683, "uuid": "7b5406a2-ad60-440a-b8ef-b3fddc8efd78", "comment": "Malware payload (Formbook)", "value": "10dcb994591c8d3f81c83dada50d4d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781574683, "uuid": "96f0b4cb-fed4-4a9f-b989-4cbb1717e430", "comment": "Malware payload (Formbook)", "value": "7e9b6481033ae24780e1816c891b9e518af44eef0cadde0903306eeed0162c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781574683, "uuid": "77ab3c9b-61ac-41bc-aec6-375b7b14f475", "comment": "Malware payload (Formbook)", "value": "4a525af08f7ef5d9ce60bc888918124e4203ff53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781574683, "uuid": "a37eae13-f017-4922-a764-336f62b99343", "comment": "Malware payload (Formbook)", "value": "e9e0b414f6661d000cb37a7b58bd231d77fd8deced83493d290419a88a3a435741749168934111b3fe4e6c7bc495b513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781574683, "uuid": "6db0853f-ba3d-4f79-b545-52f36b2811c1", "value": "T18135126423269613CB5547B50A71E37607BD7DDBB911C25A8FE86EEF3A29F088D00393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781574683, "uuid": "7c211e07-1df5-406d-8c74-c7e6a337f9c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781574683, "uuid": "4ef0614f-342c-478a-9e25-e8fd722e009e", "value": "24576:b0/2POAkkNigr60IM9rKmJf2/IjMScPymfixjJZqKBPz0:nziE6zOu/bScPb0ZqKBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781574683, "uuid": "3e953879-92af-4b59-956a-9f0204b5ec1c", "value": 1078784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781574683, "uuid": "8fdf97e3-496b-4ac9-bcfc-93fcb3883674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781574683, "uuid": "c9808dcb-8d3f-4711-9426-b6d90d20bd7e", "value": "BULK_EUROPA-2_SAILING_ORDERS_VESSEL_PARTICULARSpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7b8e5e-696b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781604688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604688, "uuid": "eb96857e-28a4-40ac-b111-21754716e55b", "comment": "Malware payload", "value": "566ed340473165c52c657d9915ef68cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604688, "uuid": "d2337de7-1798-4a73-907c-c557050d84dd", "comment": "Malware payload", "value": "7f53e619b301e79c68a3474dacfd2fc7bfda3090b97e47be253169be7968736c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604688, "uuid": "347950ff-e7d4-49ba-9b1b-f459677cca68", "comment": "Malware payload", "value": "c0cee7bea7b3565a0fe9a34fba4080e21c64c621", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604688, "uuid": "f8175a78-7f38-4af6-bbda-059db2f4a2ed", "comment": "Malware payload", "value": "3fc2ecf46afa604bcf5f54f1af289c0772a93e57006bccc18d5d0869c1e69a7fb827d7f795dcd0328f8e3240a5c7c606", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604688, "uuid": "60065bba-b24d-4fa1-9c31-4524877d637a", "value": "T1C314E809AB510FBBDC6FDE3702EA074539CC651722A43B3A3674C528F54A94F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604688, "uuid": "665568f4-5a85-4584-8c06-b139bcdf80fc", "value": "3072:QAXfo8SID5pExrNDAfSm62ycf4PxhQAH5PWnZ:QAXfo8SID5WRDAUeQPxhQAHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604688, "uuid": "6197c063-e267-4d66-987d-db720d17b88d", "value": 201000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604688, "uuid": "81e9e203-deee-4e64-950a-a6e21324ea3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604688, "uuid": "a99cf7b9-e50f-4447-9aec-683f08bde50b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3999237-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605557, "uuid": "00df7960-704a-4b53-915a-ec4e49e0595a", "comment": "Malware payload", "value": "0afe31cc330dc903ce55b7ab26826102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605557, "uuid": "ea34654d-d652-48cc-80a6-02131152c22a", "comment": "Malware payload", "value": "7f93849379474bfe0b1d15d921cb3d4a0b6789bbcb4910f932713705acffe9a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605557, "uuid": "f38ab93a-fed8-46cb-999e-00e9e50e1244", "comment": "Malware payload", "value": "9ac3d2f28718391780df46c4ca0910559f6ebb48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605557, "uuid": "1d179c8e-3ff3-4ab9-b383-f468b8a71785", "comment": "Malware payload", "value": "879c7e5bab8329b18eeddce21b4e6da186bb9828c6abed04d3b0d5ce18882aa1db5d6eeb83a9b544e01d347db4e1c176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605557, "uuid": "89300003-5359-4388-bc76-43685cdee582", "value": "T1DE56F157FCE228B7D0AAA231886691517A61BC493F3213D33E90B37C2F72BD05A79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605557, "uuid": "16d92f3a-f86d-456d-afa3-d5211bcd4d38", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605557, "uuid": "ff279f34-1b8c-45f7-8c42-5f732ce3824e", "value": "98304:0xcvSwnGDLCLRlRrn49JdYg2AjVkmtPLtpQNvp/2JT/0MHEHW:0OYHCLRSJdYWmIP4NvoJTMMk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605557, "uuid": "e133d4b3-f280-42ab-8542-9daa5c450fa4", "value": 6459208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605557, "uuid": "950a0676-5848-49b2-afc4-49ce068a9a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605557, "uuid": "42d786c0-41eb-4c8f-a29b-5c98013f1f19", "value": "7f93849379474bfe0b1d15d921cb3d4a0b6789bbcb4910f932713705acffe9a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60e5477-69c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781642901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642901, "uuid": "88af54dd-424a-4d99-a7a9-533bd23e2654", "comment": "Malware payload (Mirai)", "value": "4a26e97a3e4118e1d629ad7a9c55cb89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642901, "uuid": "562d0ce3-f7e9-4551-9bbb-482540b1d02e", "comment": "Malware payload (Mirai)", "value": "801715a65dea9632714c1ad886e0eb162fd3f33aa973a87cfdc3111b535e193b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642901, "uuid": "61dbf082-caf2-4cce-b5a3-a50fdad3f414", "comment": "Malware payload (Mirai)", "value": "5b6a5a9a6555e5042fd43ccae94f2f24707fd470", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642901, "uuid": "4a05d0eb-23af-4421-9c96-639717207337", "comment": "Malware payload (Mirai)", "value": "8c5624cce4a68edecbfc0fa33afcfb09ed860b39b1edb0424b228531e859d65960b1cb733aa0df363988a068653880b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642901, "uuid": "87fc4d21-8f86-488e-a3d5-332e8fb2f542", "value": "T1656312C4E6E0A391C09A67BE548D732E1FF2E15DBB48096BECC401E1267AFF53171166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642901, "uuid": "c6020649-ed1f-4400-a97f-df5c5e3765a2", "value": "1536:7dMSC+SbQyJeyTss6qvZH/Pv4PG7Rnouy8rye:7+SvSeGss1tD7Routp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781642901, "uuid": "d8dae69e-0109-46c0-bfcf-c1311cb0f3d8", "value": 67656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781642901, "uuid": "e447e616-381c-4458-9432-f87154a36b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642901, "uuid": "9c168443-5e94-45e7-b05c-3629bd92f021", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c4966c-696e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605675, "uuid": "50733746-5333-4e35-86a1-a7864565e02c", "comment": "Malware payload", "value": "537a50eedeca669d82c4dadacc1c1af4", "object_relation": "md5", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605675, "uuid": "53cdb41a-e61d-414b-b227-6ac7d728e3ea", "comment": "Malware payload", "value": "80d94adfbb5e8a4b995a3194d102d5115b2805485c3c7dfd2a1c8db9500075f3", "object_relation": "sha256", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605675, "uuid": "e5131db5-0cd5-4726-8f41-23583cbc2601", "comment": "Malware payload", "value": "96977b4adad178f325c6a0c01c3faa0730fc61e0", "object_relation": "sha1", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605675, "uuid": "597f7ccb-7be7-4972-b164-2ca957cf0603", "comment": "Malware payload", "value": "5e295c82d277d5d0882e13fe1b9654cc97a540da9840ad2e77c9e9c74759291a4d95eca55ee2c42957922fbb442127ef", "object_relation": "sha3-384", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605675, "uuid": "55f56858-58d7-4732-99e5-14241767e9e6", "value": "T1EBB53339C194ABEF33C243A22C292E14ED9C10650857DA41FF1DC79177ACDAAC37C6A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605675, "uuid": "fc3d4780-4cb4-488b-89ad-959e75faab76", "value": "49152:BmC/mKkbXiBoPRZ6N9wyzazZbDJTyIV1zm9ur34O8zu9UUonLTqZHmA4/OjL:BXpmPb6zwyzalbwJO8BUoSUA4WjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605675, "uuid": "3ec95de0-2a26-408b-afcc-aacdf3544fb2", "value": 2429988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605675, "uuid": "57b8675c-d91f-4cb2-b4a2-b7d1b7783731", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605675, "uuid": "844fb0fc-6cbc-423a-b37c-7d76b64c6abc", "value": "procespro.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651c75d8-69cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781645772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645772, "uuid": "835a7441-52aa-4f32-aaf1-2157a7db4a51", "comment": "Malware payload", "value": "eac473b2d9dec215b8462cfa92a9d894", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645772, "uuid": "a1196729-2e33-4b91-be71-800fb1d87cac", "comment": "Malware payload", "value": "81f8a4d33b2d8fa5614e66e9e30d13d6d685bb65e10819ebb18da74164d2a446", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645772, "uuid": "fdcb50ce-79d7-4e98-a2d2-cb04a46f5bc2", "comment": "Malware payload", "value": "3dd3bdd64b1de89d15a9d847dfdad6b742dafb1e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645772, "uuid": "2f7ebfa7-2289-4232-87f2-023e6e785934", "comment": "Malware payload", "value": "9c4990a8b11794f9b7798017da2f4e250ea38b76b6eb13158743b3dfac63eaff8d4c2b59d363c4001f046adc8df300c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645772, "uuid": "c8157bd2-f3f2-4e65-8482-aa6b1a71c2f9", "value": "T158D02E2262730A3094B29824E0CAAC80B2080B7F0E0AA2AE788B60313F40304F2D26A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645772, "uuid": "e0ae25b2-f491-4f4a-b5dc-af764e870952", "value": "6:hTG/sp+4RxaPMbAulNXYq4HvXDG+NjVsNXYrkJ:VGkp+4HXbPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781645772, "uuid": "921227d5-0043-493f-98de-32011cef0552", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781645772, "uuid": "72f7a560-961f-43a3-88d8-37df2c3f1c75", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645772, "uuid": "3ca989b6-9356-4f8b-802d-c5c4d7d001d2", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5960b5d-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607735, "uuid": "a94ee0a4-9114-4cba-8c7d-b97013b721fb", "comment": "Malware payload (SilentNet)", "value": "ad98b728bf2e74ab2bc7b391a42ae8c0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607735, "uuid": "6138458a-3157-4dbe-a428-afb335ad14a7", "comment": "Malware payload (SilentNet)", "value": "820ba611b17625dc91267ab289bd66854dfa0ea16cc4c46128b37cd57392d15e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607735, "uuid": "cb8a3342-dcb6-4afb-a07f-18abe3968ee8", "comment": "Malware payload (SilentNet)", "value": "a765902e125682dd6513b0fdda74acab82355ff7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607735, "uuid": "d031f574-2ac0-4189-82f6-139598be5014", "comment": "Malware payload (SilentNet)", "value": "10be6e3f6ae62cba0b2ffaa07b620a2290a0a4a7395458c8baf3aa9ea148635aca56fd978c68231bb9f03599103181be", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607735, "uuid": "a47a05fc-915a-478e-b0de-c2567689860a", "value": "T141E41257BCC3B578F253C431C5A4C622E61D88ADDA06980B2BB0A98F5C349656F1EFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607735, "uuid": "fcc7f007-0dcb-4e5b-9926-f8688e57fc87", "value": "12288:l0oMEtp+XDBcRydaQuseXfNZO1OybQCZiAs5FsTX:vp+TeGtIFubBs7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607735, "uuid": "7d3ce517-b6b8-4cde-99db-6a4dda84a363", "value": 668226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607735, "uuid": "b2d95ca5-6047-4662-a913-77affa984805", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607735, "uuid": "deb37bb9-a1ab-4c74-a443-17edad80647d", "value": "KryptonClient-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6490d5f0-6967-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781602821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602821, "uuid": "fca9314f-a34f-46f5-b7f9-bc9e3a17c98e", "comment": "Malware payload", "value": "7306ef29eda5f25f7d6f82f3cf60e28f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602821, "uuid": "8fce2e4c-6f03-4da9-9bbc-69ca86e687b7", "comment": "Malware payload", "value": "827eacf627ead40b411fe325e4df5724ae1575e0e17d0309cd14228000ae3bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602821, "uuid": "fc3366fb-3dc0-4ea5-b6c4-fd9d59f3d506", "comment": "Malware payload", "value": "0d369569b9ba2d957cb5a46be6d8bfb1a9ab7e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602821, "uuid": "c2e55f60-0f2e-46d0-af12-a548cf2c8ea0", "comment": "Malware payload", "value": "3ab5439e182fb74ddacbc2bec210def56fef9094a52b451a708b06fb6dc81133fd60f9b583d585cbd5b354b8b758d719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602821, "uuid": "7b39dc62-0335-4df5-9584-7c4f3734ad5f", "value": "T1E056AF12F8E28FBBD20B9235D8179085BA657C213FE902DF2578D7E52EB26D04474B6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602821, "uuid": "46c2c7c2-8a2a-453f-849b-5edd9fb28c12", "value": "d203f9672085bd7924a65988545977e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602821, "uuid": "74894666-2a2a-4d34-a558-24f3fda0f4b4", "value": "49152:rnR0AgMiSiaZMeVrA/oDKDrIf0kHbKvc1zm:rNMehAn3I/bKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781602821, "uuid": "89018aad-158b-498e-b154-96dce65fb15a", "value": 6393584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781602821, "uuid": "534cbc1e-b48d-4697-be7b-4edb8c6b2a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602821, "uuid": "78e9f1d4-aecf-4a7f-864f-0c58fc52cf4b", "value": "curl_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444b498c-6976-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609209, "uuid": "8bfca537-c4b9-4674-b7c3-2e7d9687a140", "comment": "Malware payload (Kimsuky)", "value": "ef9fd2fc04ef5d6c96cbc0c507a4753d", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609209, "uuid": "e69b5718-5389-4f9f-b63f-3e05d2fbf46a", "comment": "Malware payload (Kimsuky)", "value": "82900251937a81f7e565ecba4d4d5e417c4db801cc934286b7ece70268988619", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609209, "uuid": "0813b825-e9e4-41d8-b95b-5d7d7a1eaa6c", "comment": "Malware payload (Kimsuky)", "value": "223aa8d86759805096ba5e35d11faf36530177a9", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609209, "uuid": "44e7aa75-3e79-4206-b6f1-1379a94cdd6d", "comment": "Malware payload (Kimsuky)", "value": "738f630d1585627710691db801003628259b8ccbeda5074ec1105153ec32a8283a2cd7ff16292d3dd3e187dd31b4f7f1", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609209, "uuid": "df889c65-9342-4892-b786-20e57352ff5e", "value": "T1EFB132937505C3C573C5C283BA9FE9CD7704D5B901AA8E60F8EF4A0C635AC8665B4B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609209, "uuid": "7e7c92d6-bd9e-45a9-878b-3eb5df620025", "value": "96:AIAqePJszvA7JPqEaAvGzuGA195Ka2Fs3V9geCuhgK9klhgOpyCWFY+7NKePrk1r:qqeCQRaAvGz2Ka2F+Yz3HgOpRWFbKeP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609209, "uuid": "cc568674-6e13-4021-bb4c-bf09e6f6d9da", "value": 5244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609209, "uuid": "6ecb5aaa-5043-4e16-b0f8-2e7a6d3f51b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609209, "uuid": "3c188467-12fc-48f8-9f22-5de47a42c166", "value": "82900251937a81f7e565ecba4d4d5e417c4db801cc934286b7ece70268988619.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c778fc-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623056, "uuid": "5350261f-9335-4eb4-8152-c44d0657ff75", "comment": "Malware payload (Mirai)", "value": "186481e7e4fd80300eea44d9b55c572b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623056, "uuid": "f4228b96-ea96-4aeb-bd6e-23bc84a45e06", "comment": "Malware payload (Mirai)", "value": "82e2681ad8d5af8909659ba0636cc04d7016b039a22bf139300025c12eb5733c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623056, "uuid": "a05c87e5-1465-4434-a42a-5e791107e522", "comment": "Malware payload (Mirai)", "value": "1cf617405bed5756d043964cddb54475ff0075a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623056, "uuid": "e00115de-4159-4424-8395-3d36ff03b2e4", "comment": "Malware payload (Mirai)", "value": "dec7d028eecad1bf118a57e192d8acec7cefd9d716fd4cf7bd683e4d6ce08cc2a049f628cc0f1e84e42b20ca63d46a37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623056, "uuid": "66c167e8-c3f0-4712-9b84-8e99ebbabbce", "value": "T1C3D32A06B30C0A57D1632EB03A3F67E093EF9AC121E4F644355F9B8AA1B2D365585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623056, "uuid": "922d9d21-8abb-4626-b1e2-5855191ffca5", "value": "1536:ZAlkntIaz5wbvZIjbL2CxfDQO865hwwPUDqLMUAbvAdyitzAGeIDKqo2gDiz/:Zr8vy2CxV8WuDeMco+vyQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623056, "uuid": "b2887a1c-ad93-4c31-81cf-7ade1aea36f8", "value": 138128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623056, "uuid": "eba78f4e-0cb1-4fb4-b0a9-18a7baf7ff66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623056, "uuid": "ecfa895a-207f-4a6d-9d34-ecc9a11c368b", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ea6535-6976-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609215, "uuid": "460af14c-da32-4366-a2cf-73964f7fcbbf", "comment": "Malware payload (Kimsuky)", "value": "2f1050a000df9022526955ab929bbcde", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609215, "uuid": "b3499184-555d-42e2-89c8-4195e3908373", "comment": "Malware payload (Kimsuky)", "value": "843e750b1514764ea937290cb13724fc60fce10b5970a510ceba5846ac6a89d6", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609215, "uuid": "5065dffc-ae77-4304-bfd6-f1c3193ee8b1", "comment": "Malware payload (Kimsuky)", "value": "64673382f978b6de1908445889ff469555bf1de5", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609215, "uuid": "03c98f37-c7da-464e-959f-0909b7ab06dc", "comment": "Malware payload (Kimsuky)", "value": "8e7090f2ec0c06b04d31473ce1a964fd5bd7f5d84a47719c79ff44e7227c9344ced4667754719261f79eb02fcd2aee23", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609215, "uuid": "3ef2a0a1-8f46-4d8b-9995-d25a984bad44", "value": "T130B177973046C3A7A7C291837EDBF5C9320CC8A940FACEA4F8FE061D5358A5B7179259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609215, "uuid": "86655ad8-c52f-45ce-8437-b83e3f545fde", "value": "96:oFJmUyzhcURdAQ5IzHWkrumA19tgyQgwJMQS3ZQQfAgeCmhAoCMPp48AJWNLG+2z:aUlhcaDIz2krMlQOvZFz4CH8AJOLZ5IP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609215, "uuid": "343df68d-b542-4aa9-bc0e-7d0b756ed224", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609215, "uuid": "192b42a0-e553-4e20-925a-e1b12bfc6138", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609215, "uuid": "cfa28287-5940-4d24-819c-34a76164ed98", "value": "843e750b1514764ea937290cb13724fc60fce10b5970a510ceba5846ac6a89d6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a353f7a-69cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781646505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646505, "uuid": "de3dc9e0-155c-4f7b-a4b3-6e4c3cb9b4ca", "comment": "Malware payload (Mirai)", "value": "15e7f9ce7f36c00706594603a28feb7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646505, "uuid": "fcb0bcc5-cb83-4a99-9595-e6cc6e1b8c47", "comment": "Malware payload (Mirai)", "value": "8496dacebd2c594ffa5754901be34b17724fb84232081b6b0a2314f263850713", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646505, "uuid": "394d4634-e42e-4d93-bcc9-254e48b4f067", "comment": "Malware payload (Mirai)", "value": "b86197ccd7941e1b9758c840c1e98878e13cca56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646505, "uuid": "2a702c2e-e86c-41d2-ab53-5900db697af4", "comment": "Malware payload (Mirai)", "value": "0f8bdc5d018ba081e0fc46e0e01e19203a0cae782efcb23831e4cebaf3a654d0a67e101f2797fb7c4cd82987113bc7ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646505, "uuid": "9fc6b496-5e32-4d64-9600-655c6c50d365", "value": "T107B30945F8509B13C6C652BBFB4E438D7B2A175CD3EE320399296F25378B96B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646505, "uuid": "5855a3c8-b63e-4640-b696-8f00c892d389", "value": "1536:gvH55WOrvl382AgzH4VW0BwTXfY80yO6mhYqfJ18lGEwywgSlOXpf6FsgE6lvhgb:mDW8vR82L4bO7fH8Dx216nJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781646505, "uuid": "28f18b04-5e9f-4d46-a73c-22f036038f10", "value": 117536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781646505, "uuid": "baa785f6-c280-48d6-a413-99c78e32179f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646505, "uuid": "f55557ce-168f-4d91-959f-990e000baade", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb5158c-697c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781611772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611772, "uuid": "81c912aa-7999-4b1c-a1ef-3b26c36f1fc8", "comment": "Malware payload", "value": "3565554a0cf4a72c8a2209d267560b7e", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611772, "uuid": "64564a43-41c4-4627-8d04-2ccd69b692f2", "comment": "Malware payload", "value": "8503a4a1f9734e9175366f1d4f1fa67f34fd72575b06f17835e1240d1a060d74", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611772, "uuid": "e5c64e46-6340-4cfa-8ce3-a480841c082f", "comment": "Malware payload", "value": "ab6faf23e02ec75c335770d0446da51674a683e6", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611772, "uuid": "4a02d4a6-e710-4b8f-afd9-cb28105749e9", "comment": "Malware payload", "value": "11a794e74f749d73854ee913f7449e6571225d240580d4fb3884f76b90a5da1c748bb510229e1f6c042c16850747e94f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611772, "uuid": "553141df-356b-4d67-8fcb-3f48260587c9", "value": "T1DA937E9BBF3661F4DF2230314AE1649F8B4C76883E205EDB544BD297E9D1F903B96058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611772, "uuid": "0405e1e8-473d-4d20-b428-7733b32bd883", "value": "1536:fqUiaab/FKGBTBVWRxxe+fWXLjHbRHgH4sI8ANNuu9eSErW:fqUX6wGbsE+eXLjH9HZ78ANfeSErW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611772, "uuid": "90c613c0-5c98-403d-9334-f753226bc626", "value": 96203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611772, "uuid": "f86b8ce7-de1a-4784-87ab-3a93a623e283", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611772, "uuid": "cd27e08f-e408-4161-90b9-bef0c3631c05", "value": "Copy of ATR.Chelsea_Bauer (2).xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3984d9-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608550, "uuid": "778383d8-b686-4000-9648-25af48e44025", "comment": "Malware payload (Mirai)", "value": "187195d018a4fc87bd88762cb4a56bef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608550, "uuid": "051d8fa6-7e68-4ba7-ab60-8099ce3de504", "comment": "Malware payload (Mirai)", "value": "858f7d29d3d787d7089c4dcc29daf80552301dc6b4655025fec9d7c01129cbf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608550, "uuid": "e894b596-cba1-48c7-b83e-dad24a4e1d33", "comment": "Malware payload (Mirai)", "value": "f57d073ec7784188fb3fe0cdee0219d891f79f39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608550, "uuid": "5b75fa8f-81c4-4bb2-8f00-9cd479aef90e", "comment": "Malware payload (Mirai)", "value": "1d2045776d8b70a8a21ee0741e5559c0c7f2eb45a1bcfbd8cf8a76b99807809efe85b4cd7a238fe8e05213832a3bca7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608550, "uuid": "6a6e1489-3c65-4146-be58-af0e965a3c79", "value": "T159647433D91684A1E0104CF3126736869C4797BF88A726D3EF5A5DA0FF3145B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608550, "uuid": "4301199f-a10a-479e-8af5-6d4b720bab3f", "value": "6144:WetmWXMlP8ZiNyKAwjopCunowmXFvtMdxDaJaT:WetmWXMawjaCunmXFvtMdxDaJaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608550, "uuid": "eb37eb27-2371-4559-8cd9-69c1bcedd3c5", "value": 326955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608550, "uuid": "69b53394-4a57-4589-bac3-fbbb750f270c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608550, "uuid": "7e711b4c-94ef-447d-a1b7-5895b7e7689e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856671a1-692e-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1781578395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578395, "uuid": "5272a7e3-0ba9-40c4-9277-66441b95cc75", "comment": "Malware payload (Joker)", "value": "dd19b0b85e598c0cd8ce376875f4f203", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578395, "uuid": "26ad0b9e-2da5-4c0d-bb98-072c17c4c651", "comment": "Malware payload (Joker)", "value": "86272cdb72e9278138b740b069d41023c05c68b9aedb0eeb016f37f90bf2e9cb", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578395, "uuid": "6665e1d4-86c2-4582-a6fa-43e0b84fbcad", "comment": "Malware payload (Joker)", "value": "71896f00785e5bdaa32393eb264b6faedc3d0ba3", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578395, "uuid": "22fd3829-b03c-4f62-9c24-3d01f217a9cc", "comment": "Malware payload (Joker)", "value": "30af1e13fb2f500ae9bf8ab93890456488bfaa2ff6f33791d1f6be27cbd3952b3cda88be1539c941b8e532c8db9058bb", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578395, "uuid": "42e80768-99dd-4d3e-9890-59289f607914", "value": "T13F47E089FA1CD93AC9F9B0BCCD8B06A3B5127D114A14C1973821770DF8B37E19A95BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578395, "uuid": "12361039-dbcd-47a0-987f-35afd3c0a310", "value": "393216:pHJhQIKkQ90ahZ2cDOtxLXb9XNDdyDdfzrQxCuKrW701QCFl:tA990avOXLXb5NDUtcFv4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781578395, "uuid": "03d96525-c24d-43cc-bbbb-58648111e2be", "value": 26268821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781578395, "uuid": "15ef8ddb-6fe7-48b0-b674-3c9339ad835d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578395, "uuid": "5d8b63bf-1e14-48ac-934a-17b465113b27", "value": "Easy+Chat+Message_3.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bb4acf-6997-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781623591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623591, "uuid": "6e6acf08-b5a7-4ee2-b4df-d26408342513", "comment": "Malware payload", "value": "061e19551e459fa1cbdeb679406f7bb8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623591, "uuid": "81f9f1b8-6584-4064-8af9-6e17b7f8ce74", "comment": "Malware payload", "value": "86ef8c8481f5fc8f8ec6290b54e727ce450ab6dc0f0333ee99db10333a7535ec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623591, "uuid": "6c3a9d26-90d1-4dd1-82e4-ee88e18cdb52", "comment": "Malware payload", "value": "4bffc6bb61ad6c872c4494fbc2eae4dae8dd7be2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623591, "uuid": "93ad6a37-af40-4fb7-950d-58b758b07173", "comment": "Malware payload", "value": "3ee27a61e4a12eb70a6bc97b30f231d4f2162dcb58302bed57f582627edafcefe88f6cefacdaa75d0db55e9b3f25e84e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623591, "uuid": "63ea826b-9c13-42d6-b22c-71b1ff8c696f", "value": "T179B5AE83F6A641F8D47BC174C6524273EA7274990730BBFF429486692E23AE59F3C391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623591, "uuid": "35df5100-7a54-4dd9-ae8b-1abf05e532a3", "value": "7cbfc759415f6fbd86dfdb151140bc32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623591, "uuid": "762fe842-a98c-45d8-a27c-0069baf7d8c9", "value": "49152:T0/5YGHlOiDJR2zojkpr9axCnNiIU6iZP4hnN:TMLacg+Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623591, "uuid": "e04a5bf1-d9e9-49ec-a959-26c23b0c6f48", "value": 2328064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623591, "uuid": "74b1d952-f173-4c86-a692-c65d16720776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623591, "uuid": "98f52f76-7a08-4483-8982-bb5b8c221c6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c0402e-6988-11f1-a769-42010a9c0008", "comment": "Malware payload (DrunBackdoor)", "timestamp": 1781617074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617074, "uuid": "1dbddf2f-a8c3-495b-b16c-82976c39c028", "comment": "Malware payload (DrunBackdoor)", "value": "6bc2ac222f8d27464fe186b5f2a055e7", "object_relation": "md5", "Tag": [ { "name": "DrunBackdoor", "colour": "#8207BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617074, "uuid": "a1dac795-494d-477b-a2b9-8ee3fa55f87e", "comment": "Malware payload (DrunBackdoor)", "value": "879950da6d18cac34619af10099bd5cfe766436f6ad2df7aabd4d5439154f462", "object_relation": "sha256", "Tag": [ { "name": "DrunBackdoor", "colour": "#8207BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617074, "uuid": "a8e9c20a-a657-4462-aa40-d33a87d18cbe", "comment": "Malware payload (DrunBackdoor)", "value": "5f029428932c332ac9939d21234bdf37657372be", "object_relation": "sha1", "Tag": [ { "name": "DrunBackdoor", "colour": "#8207BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617074, "uuid": "44f161c4-f316-4986-92ac-64315f2b1caf", "comment": "Malware payload (DrunBackdoor)", "value": "8843f04cf55ae175b617dc95d40d76111c16e65cb7611dde81a578af52a582fbfe030d7daeaaf307377baa62e5b0699e", "object_relation": "sha3-384", "Tag": [ { "name": "DrunBackdoor", "colour": "#8207BA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617074, "uuid": "71a737bf-62f6-4e2d-9c93-b7351245ad96", "value": "T15CD59F4BB2B800FCD167C1B8CA075A17EB72785513359BDB5690896A6F23FF1267E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617074, "uuid": "2fba533f-4b4f-46dc-b4cd-b1ee0e242190", "value": "ccdae0e103680622a8f8744abc63a802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617074, "uuid": "62313028-45b3-4b49-8168-d7b3209a3c07", "value": "49152:YeoKBKxtJfyOnnrJv9kaWZ//70ahSMr3nxI6zr:YeIC63uoqxzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781617074, "uuid": "cef54f11-be76-4080-a17f-1a5db88a750a", "value": 2914304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781617074, "uuid": "dd4af4a1-c554-4e24-9455-1c2ece8268cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617074, "uuid": "5d927cff-ad7f-426a-8106-d8141ac227e5", "value": "879950da6d18cac34619af10099bd5cfe766436f6ad2df7aabd4d5439154f462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64ed455-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608542, "uuid": "80813c24-5c8b-4e4f-acab-81ee5b382115", "comment": "Malware payload (Mirai)", "value": "00a7848305952d16c1276d902e97d85b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608542, "uuid": "c847e88e-803b-4a08-bef5-241c7914395e", "comment": "Malware payload (Mirai)", "value": "88789729dd13a90e8bd83bd96f29db406bcac371bcc0258c1f6681b4c6d3819f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608542, "uuid": "6fbd7827-d2cc-484c-819c-afa6ae140214", "comment": "Malware payload (Mirai)", "value": "83a0f58ff913308cdca94d5980784d0c596e074b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608542, "uuid": "100c0476-c8a9-4145-b4d9-f8f644c7ea47", "comment": "Malware payload (Mirai)", "value": "1fc7653ca905fba12cf463e0e272a4461c24e7f6098d294049ed00fc03a6de3637227d319d804b0cdcf43dac40132212", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608542, "uuid": "d0a29951-4f3e-49c9-8890-2f492ce3f96e", "value": "T19374B93399194595E0258CF2227733919D4B87BF88E722D3EE1A5D90FF3142B52BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608542, "uuid": "ccd9c2ef-f992-4fad-8228-6d29d4230e61", "value": "3072:WzSvYU2fUt+qaxKwjoCdSNiEPmX/ItseRiaKANb:WzSvb2st+9UwjoXNiemX/ItseRiaKANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608542, "uuid": "a3f5edf3-ed27-491a-9c7a-0c48f3505879", "value": 343403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608542, "uuid": "ca2a7698-84d8-431e-b48a-747533f2ab36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608542, "uuid": "de02a5f4-3cd4-47ee-b4fb-9c54d408973f", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf185877-6969-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781603859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603859, "uuid": "1b06f8fb-715d-4c6b-bd0e-3f620189f505", "comment": "Malware payload (ConnectWise)", "value": "a74dda53a5bd51574dd0dcf6c4fc3f19", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603859, "uuid": "d0ae2502-1ee4-44dc-91cc-874ba7e03d70", "comment": "Malware payload (ConnectWise)", "value": "889e20486aa636bb4691c3744afb7ab132a6ce0343afdcec69b9ff65b83921ea", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603859, "uuid": "ccfbe43d-c892-48f4-ba9c-7dd796d5c2f3", "comment": "Malware payload (ConnectWise)", "value": "e805c6c29a90bc26175a554575356d4214c98aa7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603859, "uuid": "a1246ea1-6c41-4131-9288-84802b9ac616", "comment": "Malware payload (ConnectWise)", "value": "1e0404c43fef5e575e82409e4b83769a117b43af5acd0d332f4835195fc67d5616e0804f6d26acc5d0b4f21b36e10ac7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603859, "uuid": "3e56d4db-bad8-408c-b8c3-332424df60cd", "value": "T199646C11B9C48432C673383107B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603859, "uuid": "4675d7e0-cef4-47a0-b302-3541947397a2", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603859, "uuid": "7d6cfc56-5b90-4d95-af23-24d0f2cf0886", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9h5:51iw7gryNkSV1hy1Z1u2JLI9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603859, "uuid": "149acc1e-66f0-4591-a55b-0bd24145d507", "value": 312584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603859, "uuid": "636cd1b8-81f0-4888-9054-d0d830b105b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603859, "uuid": "f08bc116-d562-41da-aa8d-ee65c6e1a8b8", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b833874-69cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781645836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645836, "uuid": "967a6dde-3679-45bc-9a57-3ec27113cb9a", "comment": "Malware payload (Mirai)", "value": "67d7defdc42dc78efb39cd379d57bc12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645836, "uuid": "9239f085-a718-4b8c-a488-bce476ee6cdb", "comment": "Malware payload (Mirai)", "value": "893fb76c3be1ef821fea1b3f581418338a1a22e5b598652bf3934eb60de67ea0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645836, "uuid": "11f29c3a-738e-4d80-9a65-cecf1347d940", "comment": "Malware payload (Mirai)", "value": "2fcdf909b9504f495dc1411b726be0734d2f63a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645836, "uuid": "677c6257-3e9b-46b0-bd32-2491f4626715", "comment": "Malware payload (Mirai)", "value": "ef555a699600eaec38d4360cfb272600312ba60b434337fd5085fbd0edc5e519a28b6c1ef5e9c12833b19d1a885f0c62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645836, "uuid": "338d9886-1c1b-4263-98c2-5a6ee09d63d2", "value": "T178149E33D4646EA8C664A4B4F0F5DF7C1B53A55181472FBA2AA7CA7440C7E88F90C3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645836, "uuid": "1a05e801-892f-4966-a3d9-24e2ed5a761b", "value": "3072:KLLxVbS6z9J/mrHjCUZu794qXDOrWyW9IAWYmzb:a33/m/pZu7O76Z0YS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781645836, "uuid": "7f502191-3a46-4c4a-904d-caf36f963bc4", "value": 191428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781645836, "uuid": "a84526bb-2a6c-4101-bf30-269247a5f3d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645836, "uuid": "5e1e6bee-64cd-4593-804c-b85a9b4de1a9", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7a142b-69d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781649975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649975, "uuid": "56023d73-c00a-4b6e-b904-79e6c099ef89", "comment": "Malware payload (Mirai)", "value": "0428f3595f6d2f5ed7dc0045b373f4d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649975, "uuid": "dff1162e-8457-4e7f-95f8-ba017188c3c8", "comment": "Malware payload (Mirai)", "value": "89e02650af8638b033864915b01e7a3ecd1aae55d882976bc3e3b7b52d0b4d30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649975, "uuid": "3d5a9113-81d8-4882-b811-539d33a68f8c", "comment": "Malware payload (Mirai)", "value": "ba73ed9edaabbda63c3dfa2ad558db6cfb90fc18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649975, "uuid": "9dd98116-4e15-428e-b986-ba9d56c205eb", "comment": "Malware payload (Mirai)", "value": "7aafc88f009f1c5cdb3b2d13008b4d37bc918bc7b75c6a04d4adcee45e89c6411f759efd9f4c50ee4f729c3684cfbc01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649975, "uuid": "e4fef3ff-f24d-47df-86a9-a299dc5a907a", "value": "T104733B81F54B80F1D847487090BBF33FDE31D69541B5D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649975, "uuid": "837f8b33-909e-45f5-8a86-3f7490a9662f", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+Zsb5SfFWLIk1Q9j+Lxty4AHd:uVFrPNQn+WVQ3E0VUk29jgxOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781649975, "uuid": "f200683f-dd30-43da-992c-18e6f6634050", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781649975, "uuid": "4fa5103f-8af4-41c3-9887-0546b31e0958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649975, "uuid": "ed30eea8-f509-4d1a-9046-7d4a3b0464be", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e8d4f5-6968-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1781603353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603353, "uuid": "80aaad03-73e3-4179-ad6e-3e04df4de665", "comment": "Malware payload (Grandoreiro)", "value": "b2a88c0e5cbd689ccc8647692699fda5", "object_relation": "md5", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603353, "uuid": "a5c78a27-bbc7-49e5-84f7-9639ea010bbf", "comment": "Malware payload (Grandoreiro)", "value": "8a39f1b359e722b45c7e28013eb44f212341e7eeaa68667c86936f3adad03c96", "object_relation": "sha256", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603353, "uuid": "af0d3c55-37f7-4e5a-a566-a77afdde86b8", "comment": "Malware payload (Grandoreiro)", "value": "8b44cfcf4632d4aa69b4fff4ee2f01e970112483", "object_relation": "sha1", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603353, "uuid": "3e3d4201-c48e-4c98-8b00-b9e16547acb3", "comment": "Malware payload (Grandoreiro)", "value": "32f693a5afbff88d028ab18bbc351044221b7db8b82680c9d4c59601133038a028c9cad41c26b789eb328ef3da1d6cfd", "object_relation": "sha3-384", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603353, "uuid": "fa2e760c-f671-4a75-a389-aebe1385fe7a", "value": "T1F7512BE7846623A7F0C3F739B1E077C67D56647AF4311EC2E50A64C65C502C461A0E7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603353, "uuid": "0c31b234-2065-40d9-a8fe-bcb32daad104", "value": "48:9dMRdrXi8H+uA5th/9X+An628gHuea2+6PpT8VaKP9ZRCL/O7RVYtmQiIZc7MJ:ULlH/A531ue8gOSvPpTlKFHCL/O7ROfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603353, "uuid": "691e9b8c-68a7-4d62-8b0e-8889547522c4", "value": 2783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603353, "uuid": "639b80d8-94c5-4d05-93d9-8652de076baf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603353, "uuid": "2da10c60-2802-4df2-8f2b-a849cb5d5cf7", "value": "Document_71.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a31e21f-6978-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781609971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609971, "uuid": "febf8fb6-f4ac-4008-9b5d-91df8151b712", "comment": "Malware payload", "value": "a5d0faff8c65321aed5ab11c879eaeaf", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609971, "uuid": "6a1a3d91-bddb-4c54-aabe-40d019f1cc63", "comment": "Malware payload", "value": "8aa40857ffab2c288c9953f1deed5dbefb1ee1ffbc1c0b95197c3d9af74af2fb", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609971, "uuid": "8f6d5296-2b78-4b5e-98cb-eaff1f45693a", "comment": "Malware payload", "value": "50959ed4e691788b6a5fde3fc8e3e07a6ac2b0f8", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609971, "uuid": "c8c5938c-8f83-4492-b31d-0b2bb564ae9c", "comment": "Malware payload", "value": "35c680a1accd7285294a44e109476ba155e6fd3f92e763ad00e5936764b4acb663e4c98538cc007a352d093195a0bf73", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609971, "uuid": "30680b10-720d-44cb-9176-e27b26c95bf9", "value": "T1B8F6123FA18B653EE06A1A357972A610593B7E2165128C46B6E4F88CFF350F11D3F782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609971, "uuid": "8b0e28f8-bc5a-4f51-b3ae-6f9d75d9b22b", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609971, "uuid": "74b63c5b-10d2-4f9f-8384-81f7158d2dcf", "value": "196608:rrLwzbbQWE2rGC16HYKRU3laBiboxk1pnf:rvw5E2rGC1AYKRU3CiX1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609971, "uuid": "54b94a3c-a8c8-453f-ab7e-c264efd89b58", "value": 16226888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609971, "uuid": "be427d4e-7343-4d59-92dd-b37c6b2bec04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609971, "uuid": "d56b14ce-cfbf-41c9-8a9e-53fcdca7a3a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43683daf-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781650440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650440, "uuid": "b3634412-07c5-48ba-af87-1c7c96bcbd49", "comment": "Malware payload (Mirai)", "value": "cb70b7b31887bb52e6343f409a9cb8e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650440, "uuid": "6d17fbb3-ec14-4e2b-a4b0-919ed508c95b", "comment": "Malware payload (Mirai)", "value": "8bb88de52151a206a010e81343bb745249548a431e42ba11ee77d7fd205ac501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650440, "uuid": "03c30d89-2dce-42f9-b511-d8c17e642c42", "comment": "Malware payload (Mirai)", "value": "4907ce69196006eabab95166e17ce7423fc9db22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650440, "uuid": "c09d55b9-0f68-400f-8123-1ffa956da8d7", "comment": "Malware payload (Mirai)", "value": "39f9a1f5de37902e60fa2e94b37699d9b7b41a770a77b913d3f345b2829b915fd4654ca61039a4ffdea1fbe1cfaa02aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650440, "uuid": "b1a7a2a9-71e9-4c69-bd0d-c8295acf34f2", "value": "T1B6A34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650440, "uuid": "824cbd5b-0a3b-4004-94b1-6bd1372c8181", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0oLj:bbbmPTO930bkbRl886Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650440, "uuid": "610b3a50-314e-4548-974e-d39598537f4c", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650440, "uuid": "dcf2f574-71d0-4e53-8e06-6f395b4dacf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650440, "uuid": "7ed62fb9-d628-41d1-b8a9-22ae6d22ea60", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beef3623-698f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781620152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620152, "uuid": "ab572fa3-6097-4e1c-8d45-2d7f387a9b87", "comment": "Malware payload", "value": "0c3fbfb026458f560cb43c57192fac47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620152, "uuid": "92a8b312-8ec5-4462-a29e-48023b88b64b", "comment": "Malware payload", "value": "8c55986e04997849787d00fbb3c2554c843c51ab2d488540e4c04714a9facd12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620152, "uuid": "05acdab8-3240-4336-93e4-77eba2f7a034", "comment": "Malware payload", "value": "4ec6a9387db628258440bcfa768d6e1b93a005bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620152, "uuid": "9e80ad72-1594-4fe3-b470-041a149901ef", "comment": "Malware payload", "value": "9dc5b285dc44c6e76701321f097f7bfa035e4b311dfd363242bdd10c0d1a3496d4ccf97a8606be052c66aa4b950c6a71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620152, "uuid": "00d9497e-a8fb-48d7-a230-c6e973c55240", "value": "T18DA3F885FD504B57C6C652BBFF4E438D7B2A1758D3EE320399256F20379B96A0E3A102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620152, "uuid": "35e44562-a113-4664-8eee-a509de96d428", "value": "1536:DprUhM1xANpZn4Vxm57r6VX7/+OXFbQ+QsnklO0wyw47cDlRiHdsfxDtZJQ:DhUK1xS4K5H6ZE+RjJzJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620152, "uuid": "ddb70e43-d180-4d54-8e22-55394dd0762b", "value": 100940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620152, "uuid": "47d86eb6-9480-457d-bf47-70133b02e097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620152, "uuid": "56b74fa2-6fed-4bf3-baf8-fec8a03f932e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef65b857-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607778, "uuid": "8f43db7f-2ad2-4925-b212-b83de32beb03", "comment": "Malware payload (SilentNet)", "value": "0aa174ef161f3eab5dd93fae034c8035", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607778, "uuid": "5b774bc8-9a0c-403e-b48b-56ce08b697fe", "comment": "Malware payload (SilentNet)", "value": "8c6be2ab38f9d5fffbc7200a542022f2cc78f539bdb6da9df2873cbe462df16a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607778, "uuid": "43a9bc81-5f3d-4d02-ab05-712de4cd2f7c", "comment": "Malware payload (SilentNet)", "value": "a585c2f973e6516ae6a41403b422d8f59ad370ac", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607778, "uuid": "b560b6c9-17b0-4450-abbc-e6c41f14df70", "comment": "Malware payload (SilentNet)", "value": "18495b88e37e28a894294c4552e0cf386ff013573fdf96de9df820221cb06f0fd0eb7af54ef1b27def6a01cee3a0948c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607778, "uuid": "37a06aea-9598-43fe-bf65-d1c87159f637", "value": "T1984633E9D2884EB3F5E50FFBC21135864A67A818858E1B0E02F9723DB6D5F4FC14D968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607778, "uuid": "8610a7a4-26b7-41fc-be37-5796d699d57a", "value": "98304:jpbC3ozei3FiVN1oizh3aslXf5A6jkj+nbmGFstzwogFb0dkflDKHTEZ:9C35Dh3asxjkKyBtzwogFbekflDKHoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607778, "uuid": "25115ae7-8f5e-4d26-aa80-824aaac02889", "value": 5750132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607778, "uuid": "473b8af5-2ec5-45b2-ac5e-4bc0cecbbe1b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607778, "uuid": "821e521f-fca3-4213-a86b-a8d8d418640c", "value": "SakuraClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719d791e-69cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781646222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646222, "uuid": "437672c3-2de8-4e6a-81a4-d4e7f7143cda", "comment": "Malware payload (Mirai)", "value": "f709881aeb16300d223701287c7a04e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646222, "uuid": "42204ca0-89c4-4d17-8c83-134e89c2ff1d", "comment": "Malware payload (Mirai)", "value": "8e1aabbf165e021d76d15b64730ad4b6f33ed9e6d78a23ef0a9a63a7d2b577f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646222, "uuid": "88f00f30-1376-472b-ac12-79b4f26dcfaf", "comment": "Malware payload (Mirai)", "value": "f2bf8c793a5247063db26beca0af830ee75fdb28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646222, "uuid": "d890a9ec-2b85-4372-9021-8b71e8e5b68a", "comment": "Malware payload (Mirai)", "value": "3b8bfdb63e96f8714c8ada38b0bf9b05771ed77a3902037366059ef29a62fa4bd5bfd33e76c35f9fcf72a348719f2c80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646222, "uuid": "64d2433c-dbb4-48a4-b9b8-fbbae7aec706", "value": "T1B244C71F6F228F7DF369877447B78E25975823E626E1D680D1ACC1045E6038E582FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646222, "uuid": "12881bd5-3ec1-44d6-a57c-4cd2e14cb117", "value": "6144:jpSQzOjVeJwJJc9eLHbfjj0JLKVC0JxSM:jp+JJ97jwJoxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781646222, "uuid": "28fc08aa-52a6-4f93-8606-76e68d0ed960", "value": 273976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781646222, "uuid": "45a39aca-81ae-407d-961d-d659f6b5c0e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646222, "uuid": "11d7d850-5f02-4c50-9810-85a0035ff7e9", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94500dc-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608547, "uuid": "71293d21-2a85-41a6-af37-dc5050c67b47", "comment": "Malware payload (Mirai)", "value": "22590c82c9f522b09200a126063decfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608547, "uuid": "bd602e64-8f58-420c-af68-c585f42b788a", "comment": "Malware payload (Mirai)", "value": "90f0c247608fa3b4b737996263dccbbc50c843814dfb87e92975fa0afad1c7d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608547, "uuid": "2ba3f3e8-c35f-44f6-b3f7-48400deae99b", "comment": "Malware payload (Mirai)", "value": "816607eaf02e2e7fc9449debb750f64c03e49fc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608547, "uuid": "2ff036eb-dff6-4f47-abe4-31c2c8feed60", "comment": "Malware payload (Mirai)", "value": "36286daf892272c697996f1bc2e704e6b750acd09aca663017aecff2f96e978cb138287f91eab1f6586f2a2186f9ce4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608547, "uuid": "e5886e59-e4fd-4af6-977e-c1e4e7f81c3e", "value": "T18974A573D8158995F0245CB3126B3351AC468BBB48E722E3EE2B1962FF3145B51BBEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608547, "uuid": "b8bf249a-e5c0-4e1f-9375-505b705590ec", "value": "3072:rlVip+MLdafWKvuAUJwj7Zy4xtKUf3DSMWzUq7mX/Itse84aKANb:JIdwv9Uey4OUfMzUMmX/Itse84aKANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608547, "uuid": "ce21b679-7009-4340-8dd2-b523a4df5699", "value": 340540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608547, "uuid": "e47d37d1-8266-45fe-9be0-2465704c12b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608547, "uuid": "a20c3875-4507-409b-938a-8f02d8fd97a1", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f532b2-6964-11f1-a769-42010a9c0008", "comment": "Malware payload (VioletWorm)", "timestamp": 1781601422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781601422, "uuid": "b033721d-e39f-4e8a-a5f3-8e54b684917b", "comment": "Malware payload (VioletWorm)", "value": "b5860fb24c90f6c3e7e40a0479454a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781601422, "uuid": "80cdab5b-8203-4328-adab-3a185ed2d86a", "comment": "Malware payload (VioletWorm)", "value": "926e8f1a7f349ff1eef31f89fa8ffe265c30b92e310e8bea19962d38f8c32129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781601422, "uuid": "0e00c960-76e2-48bc-8bda-4e0a4f6b3c25", "comment": "Malware payload (VioletWorm)", "value": "36cede86d464dacbdc9020082f98e77de0a31bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781601422, "uuid": "4ad7cba4-212c-42dd-821c-990fb3661546", "comment": "Malware payload (VioletWorm)", "value": "6c62aacc2ce3de49dd0f39a80650763ccf56068485eef7e40d0e7393696a4efdb3caa0e46b7591425d0b11d1116a480d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VioletWorm", "colour": "#353DBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781601422, "uuid": "7e7d5050-ae8f-4609-8efc-cbd26d8f2de6", "value": "T12165371BBCA505F6C4AA5332887661917AB1FC990F3223D72EA0B67C2F767E49D35304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781601422, "uuid": "31eb9e66-5a60-4a89-9d7f-e55a200abf57", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781601422, "uuid": "6aee78dd-656f-4505-9e25-5918eac6b4fc", "value": "24576:QrIXoD2nBm+dPy1bnvgvMsBx6/NBele5yKD9eX5ym7:QMo2no+dibovM82o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781601422, "uuid": "b1b738f2-e030-48a2-b575-8915a9f7f13d", "value": 1533440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781601422, "uuid": "b10882af-2d52-4d7c-bee4-eeddeca08ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781601422, "uuid": "5255ff2d-605a-49c0-ba84-64cc72462cfe", "value": "926e8f1a7f349ff1eef31f89fa8ffe265c30b92e310e8bea19962d38f8c32129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f1beb3-6954-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781594658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594658, "uuid": "33fd0237-178c-40de-995c-1143bfb5b3cd", "comment": "Malware payload (Mirai)", "value": "f06536a93c037b72c5fa08487ec6dea4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594658, "uuid": "5c78928d-4043-4079-ab31-17537ce00646", "comment": "Malware payload (Mirai)", "value": "9382c5cd3950e6f8d50e9a77f09bba50d28c77ca681f4afe5e9fcb752dd32c51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594658, "uuid": "2a10632f-1f03-4579-aa13-fab56d4a2edd", "comment": "Malware payload (Mirai)", "value": "c445fc03dde99617a446b565e1826e437474d908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594658, "uuid": "4a8c3cd9-f041-42fc-b1c0-2bce742cd835", "comment": "Malware payload (Mirai)", "value": "08d0da6d5b176b7b82d731b511f7995c7863b5dad1680826f15708fafccae985c045f1f8932a783a090463ce69e5255d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594658, "uuid": "45de6807-25fd-4e52-8b47-9e1d456a9998", "value": "T161A69E1FB1B255ACC04FC470579FC2625A70B4B81638393F3B85AA742FA6D6523ADF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594658, "uuid": "18fe527a-c51f-4292-a505-657356ba7d8d", "value": "98304:3ULUPSP8r/ukUzX0geYrP+kcAbBr88UPELobIfUO40AOMNbrdBxx4XFMhBc694wd:ixobO1stGjxfNh76EmmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781594658, "uuid": "c093693c-50d5-449f-bbc9-a5c39cbb8688", "value": 10304816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781594658, "uuid": "d21ff109-6cae-48e8-ae17-0e5f20b00fe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594658, "uuid": "8182d1f4-91fe-4bbd-8c6d-c111544719e2", "value": "xmrig-x86_64-static", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5e06f9-6970-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781606649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606649, "uuid": "fa89a3d7-3d61-44cc-8223-956198c11646", "comment": "Malware payload", "value": "9d7af9d130ddd180f0cfd5b63669d547", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606649, "uuid": "0c00600c-986e-4e0f-a158-453ab627b2cb", "comment": "Malware payload", "value": "95474a0563fffacc71a71caaecb47538194e596bf04c71d7ed18805d9d3c315e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606649, "uuid": "a1384690-ab10-4c73-8875-56c85967a4ab", "comment": "Malware payload", "value": "26fd83d64a468bb4d389b8b1d7889365dd45d179", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606649, "uuid": "7173beeb-b18f-40ca-9bf6-56fc2ef5f80b", "comment": "Malware payload", "value": "7bf1123fa01a0263d29ba40cdf16109cbe22c77d5a23fc11bfd855ad998c77ed4aaddc79bec3d4f4bd91653e811d6633", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606649, "uuid": "7c69dc3e-c7e4-4c02-b036-a5d54e12119d", "value": "T1E4F5334DC64416A1E511AE7F72DF835BF63AB4EF4C00893510B65A3B9AF1E8C460BB72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606649, "uuid": "abb5f3ad-f961-486e-b9fb-809e2b29f897", "value": "49152:2Dr+rqQqqpwm/2d4IwNHxH+8Lz0Ls8UMMAjFC7co0Rw/MCYHNMK3W2hgJLL792nE:AhQqqAwZxH+rsvcY7IKi+iW2he2XxVKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606649, "uuid": "58521e3e-47dd-4704-9545-3b6af36e921d", "value": 3499817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606649, "uuid": "37668055-744a-44a1-bf89-d4dc51582645", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606649, "uuid": "0e6ef573-f088-4d49-969c-6e250c56db15", "value": "o8gday.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fe24d4-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625607, "uuid": "3d4c072a-e5b4-474d-b50a-90277acfc18a", "comment": "Malware payload (Mirai)", "value": "24668615909ab739a817687fa924947c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625607, "uuid": "90a38f1a-1130-4da4-ae4a-1e2064bf8bd0", "comment": "Malware payload (Mirai)", "value": "95bae1bc1eb147ed4b0bbfef6641ac62e6a0aa583ab7398067e1d54a78d9c3a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625607, "uuid": "42dcef15-d8f8-4e06-9a04-d886cfc6a4ec", "comment": "Malware payload (Mirai)", "value": "e82dcb2e5939c7a451c472d084e58de69ed30c77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625607, "uuid": "0122d559-c431-431d-a31e-0646726096ed", "comment": "Malware payload (Mirai)", "value": "486a3772b5d8e7b41b730edefdcca7efdb357cb54537b1eb65d337a73091af3079bf6edbacb69e53c32a7e80d3dc22eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625607, "uuid": "1397143b-cf66-4845-b71c-155f8e872fdb", "value": "T1F243961E2E618FFCFB6C863547B79E21925C339622E1C545E15CEA011EB030E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625607, "uuid": "e95edf06-ef2b-4516-972d-154d2e1bab97", "value": "768:F0HkOFd6TCZXxNiP7kEazkEkvfL9lmgeNIb3Qqzs++zaQLnrjzgMPXHZ0TYgO6+2:XOr6eZXxNiPcgD9veN5LnrtVgz+Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625607, "uuid": "4cda5ef3-1ecb-434c-b8c9-6e928685c8b6", "value": 59188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625607, "uuid": "d923b818-c286-46f2-b5cc-65e9ce8b1491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625607, "uuid": "f816376f-f61c-4c77-80a5-9e38163d9c98", "value": "8636e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ccf262-6979-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781610416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610416, "uuid": "39010077-a437-45f2-bc84-bfb7286c5505", "comment": "Malware payload", "value": "16e1b20c47fd8195ef5cfb44c7152f3a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610416, "uuid": "7200d256-bb29-44ca-b85e-995e4b3e2288", "comment": "Malware payload", "value": "96cd16eb3bb1797f3d9357ae221c6b3626c0a7ce2716f2904d121b8ddad91c05", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610416, "uuid": "699e5499-67d3-4c6b-9f1c-66c9a0ff912c", "comment": "Malware payload", "value": "5786ae77b09722f5f8a51c0dfc9557fbf6760989", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781610416, "uuid": "804bef23-baec-4b18-b6f4-ce847602a588", "comment": "Malware payload", "value": "4d4027c247b9ea57c16e23840889056406fa4b635d5819a11016ca05cc314e4e9d3ec28a2d7e99b03a65a511a548fbb2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610416, "uuid": "179ae11b-af9d-4fa0-b2e3-0a57d2509993", "value": "T11B81A47296B98484F479E3FA619B3753F660818FE7704AC302C8B592CD721363E0B329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610416, "uuid": "b713b943-a6a2-412e-b4d7-e9e84d729272", "value": "48:9e56qGD6hX+xz4Yku6ed7VhkYHcH+TljhqvKcYss5668CjvLGFwcPTo35e4K3y:E5FGD7d5ku6edZ5ZhqE5D8CuToJi3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781610416, "uuid": "3ebc5a88-ec91-406f-b7a0-fa5671ba7af8", "value": 3891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781610416, "uuid": "424550bd-16cf-4d74-ae29-58752f542e66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781610416, "uuid": "15ca893f-f952-423e-9911-47f60312d946", "value": "jailbreaks.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97a8bb2-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621861, "uuid": "02b35712-34a6-47f7-a91b-1c41ab29b86e", "comment": "Malware payload (Mirai)", "value": "d6e76575013cac3e6354cafe11cc133b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621861, "uuid": "fc727494-b57b-4e28-8b34-632aabc68d51", "comment": "Malware payload (Mirai)", "value": "96e475a4246c419d1d6292b86f6dc3b4d09a2d6e25d3b0dd0459dbeb83a44c86", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621861, "uuid": "c71a0e2a-5fe3-4777-a0b0-478c1a8c7b6b", "comment": "Malware payload (Mirai)", "value": "23b97f211b34b92dfb0f6f20fb6a56057cc0b54c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621861, "uuid": "a285fde9-c7f9-4a43-9c3c-29f09c7ef6ea", "comment": "Malware payload (Mirai)", "value": "38c2e63f642b7a403d16a9de2baac7977fee953aa4ec55eadb77dc2f10e48beb968ffe1fd661f673562cca9fd2420629", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621861, "uuid": "81d87441-02c8-44ef-b11f-3cfe040b2c4b", "value": "T1A2F3985D6F228F6DF67C873047B74A21975C23DA23E1D684E2ACC1146F2039E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621861, "uuid": "6bb0c65a-1187-4891-be77-355786408943", "value": "3072:G6cTMS3ZRuOo5pokui9MIQyDyaIFDJ8+I:GJTMS3ZRiRuiCy3I8+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621861, "uuid": "04140c51-3315-400d-8b99-f2fbfad84703", "value": 158176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621861, "uuid": "ba89c7cb-6fc9-4798-9546-60d539b1a4bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621861, "uuid": "f4427b17-6641-46d2-a76f-8d3b3f8ed1d0", "value": "hmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce170619-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607722, "uuid": "23a5432a-b322-41f6-800b-ccb6ee2ca4c8", "comment": "Malware payload (SilentNet)", "value": "528d0b061720ce3f4cda43ec1892d605", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607722, "uuid": "7c9abd22-1039-4c92-ab11-6ba66edba170", "comment": "Malware payload (SilentNet)", "value": "97cfc16474d94bbae2b132a3ca3e33ed6fa1200f6bff485c5c5f5ebf6311175b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607722, "uuid": "071e59d0-3f75-4cd1-9dd8-c1711c4a02ca", "comment": "Malware payload (SilentNet)", "value": "4284f8d4786ff42ca56d81defaa965ac8e069a9c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607722, "uuid": "7675b849-9fa5-4317-b5e1-ecbefd1c5e8b", "comment": "Malware payload (SilentNet)", "value": "d4cc1c751822e8d60714bf307d8dbf32a1232217e614d5f0b5ef81e2b3089025101fcdd777a71491da41092a424ca5f5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607722, "uuid": "3b5e415d-7f6d-4d85-b2a5-5efa8d5f5f06", "value": "T1F50502357ECCD4B5FC07B930C52BD013BC250B696847F06638B1CE8B5D789862B6AAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607722, "uuid": "ea1ad899-8d16-4f26-b9ed-e5c273b171af", "value": "24576:O1h7Z4PzU7obbgKb9W39fOL5S5hU3ysPwDZqMc9J:Op4Y8R+9akLsPwZqMc9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607722, "uuid": "62f6d661-7666-4b4e-854e-3d5966b09ce9", "value": 837426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607722, "uuid": "d4edef98-787b-4148-99d5-343fb02490e3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607722, "uuid": "86eacc66-97d7-4e25-97ea-49e1ec4922b3", "value": "Agred-Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1a01cb-6966-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781602429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602429, "uuid": "52a7638b-9171-40d4-81a6-f84464e67227", "comment": "Malware payload", "value": "e1e1116f9c2071a214241d202d8433bf", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602429, "uuid": "a2d4c8d1-7050-4395-9f8e-496c667fdb5a", "comment": "Malware payload", "value": "97ecc85f05220cfc03dbcb05b4cf4716e6423d35a81893de3b3dcb2e2704680d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602429, "uuid": "33d5faed-a3cf-4d93-90de-0a169356e0f3", "comment": "Malware payload", "value": "d4b5c2de2055fdff2f1f1288bbbe084a75bcb9df", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602429, "uuid": "b0a27dd2-12d2-43f7-ac65-0d772eeeb7dd", "comment": "Malware payload", "value": "f035f599cf3718c48321a95c6a18dcc05ac0a79639133ea7ee69b17ddcbb53a9987eae42c6f7cd9d9801c02a335b43ef", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602429, "uuid": "9e5394ac-580d-4057-93bf-57cbbc3c9fde", "value": "T1C35107642AEA41D8F3BB9EB6D9FA2B11597BB8526DA0D48C0C40814C1822B41DD72B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602429, "uuid": "b974e17f-7ca9-4516-8034-a614e2801820", "value": "24:8YfJtnyUD2+JI48920l/QljiHr8iGyIIW3ThphLIh8qddNXuHY:8aSNrrH/V90zhLI1dLXuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781602429, "uuid": "9195396f-ed04-46b4-aa7e-a611dc0f0d30", "value": 2477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781602429, "uuid": "51f3ed75-00db-45f0-bd90-3efc1e50f1c7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602429, "uuid": "12ed7e72-9be3-469c-9bb1-c95a5da496e1", "value": "DOC-AC296A.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aced040-69c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781644466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644466, "uuid": "e5a58df5-cf61-4d3b-9c66-3d26a2f1e21a", "comment": "Malware payload (Mirai)", "value": "cb43d920b52eecd7474ddf510a6f0cd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644466, "uuid": "9fb4e5ed-1309-440d-a398-770ab6ad01e5", "comment": "Malware payload (Mirai)", "value": "98362f12d808586e6ccb3910e282fe3ff4d8c45f821ee9368917a371d3c46ca2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644466, "uuid": "9c2f0ab9-9552-4419-8835-a009c51b960d", "comment": "Malware payload (Mirai)", "value": "b4ad88dc66f4395ecdeddaff6ad0e0f33ea11509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644466, "uuid": "71967119-6441-4817-a7d9-a4bc7f24244e", "comment": "Malware payload (Mirai)", "value": "d6b8816b56f03506e4a202c41a55a8475f7a37259adecbae32eabd2d3b8abd8427ced72868ca8688ea9a70670fb49ae2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644466, "uuid": "bd68cf3a-d4b9-490a-86c7-bb01ead3a100", "value": "T104B30945FC508B53C6C612BBFB4E438D7B2A175CD3EE720399296F25379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644466, "uuid": "d2acf174-28b9-4943-98de-2fea25573576", "value": "1536:EVTl5A+MZJceRxLWfAHSm64VeURToj1cIwOQ2GKKp05kElNrwywmjb25UzUtJHsn:kJq+yueR5WfB4DRMj6S9KSS+2NJg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781644466, "uuid": "1e10ad2c-c9b9-4218-9b23-0e2b83b6cb71", "value": 117536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781644466, "uuid": "e16403ca-eaab-4a0f-b6e8-47f591c46373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644466, "uuid": "ecb7f6c9-5ddb-4978-ac5d-a46b5970abcc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e77023-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "5f89c523-54df-4db7-aab0-5c631be19a1a", "comment": "Malware payload (Mirai)", "value": "16c39667ee1d82b9eac34878c30c3898", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "d27790f7-c302-4f85-ac0d-617e8473e2f3", "comment": "Malware payload (Mirai)", "value": "989145848a4fb4afae162d977435828709c25fabc843e1441479eb4f7c8eea45", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "62a87f26-277e-4055-a3a2-dade15887f96", "comment": "Malware payload (Mirai)", "value": "7e1698c4fa4bc6d7c79e6885f37ff6665ab1ca69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623055, "uuid": "ffb1cd9b-827b-4979-8cd2-10c3fa6ed09f", "comment": "Malware payload (Mirai)", "value": "8e1c3b62331505c0143742bb8ea86dd4ffb126786506229cd970c89984ce0126007b1f4ff483a53bcafe7406f4bd30ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "99d014a2-ed98-4a59-96a7-538877004ba3", "value": "T16204C916AF550FBBDCABDD3706E90B0139CCA44722A53B363674D528F54B50B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "52a15533-6e36-41e8-a1aa-e7c5d80ace82", "value": "1536:iR68goF3d3lbdJqidJqXLIwlY7y3Fe/67/USZQKoXK0jURze/DZfIiMwMAMeCHXd:i6hoF7S8JzYcSfuwz4DZawMnwhVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623055, "uuid": "e672498b-ff9b-46b4-a467-b54c6a0fe93f", "value": 181836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623055, "uuid": "db11b96f-ddf5-41a1-8342-829981c19f82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623055, "uuid": "88e7b0bf-205f-4090-a542-ac1dedf27a4a", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4624515e-6995-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781622527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622527, "uuid": "3fecc675-8f71-4b06-ad78-7a11a0c4c143", "comment": "Malware payload (Mirai)", "value": "091e5910d5dc3793b6f03db16b4203b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622527, "uuid": "bb750aa9-937f-4011-bd48-443478b940eb", "comment": "Malware payload (Mirai)", "value": "995dc93561b55f9dcd62c1df99012eabe67015bbc20388cfbb3c9ae1ff745763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622527, "uuid": "4196a7fd-0b04-47c4-adbc-2f69e1e295e2", "comment": "Malware payload (Mirai)", "value": "02199bafd22d9b3de6a4f9454961326acdb4d448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622527, "uuid": "4b669726-a7ea-4133-bfd1-fccefc47fc9a", "comment": "Malware payload (Mirai)", "value": "a20c286635633e9f642cda68a6aa0f06fb349d7a8df5d931831283cdd11a8b8acb5930e6b19ee667d7f2e1a8ae0b77c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622527, "uuid": "6a66af35-3edf-438e-a3d3-4864bce6e317", "value": "T1DFA31200512F059A4C683A7984D747D7F45E8EBCE53B2AC22874D6190D8318F86AFA7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622527, "uuid": "2b1f94ce-9cc7-48a4-9a26-1cd1adb9502f", "value": "3072:f69WltvdQ3lydpBTzbQYPbV4MLzRomiq154AbX:y9WT63sDBsYPbV4MLz1NZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781622527, "uuid": "9192c7ac-574f-444b-a60b-4349bb6b103b", "value": 103864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781622527, "uuid": "854c42f6-5c4f-409b-ad8b-2e532153723e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622527, "uuid": "9014f321-c91f-4adf-885a-57deb130c769", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed3b6c1-694c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1781591188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781591188, "uuid": "aedcfcdb-465d-47de-acbe-0af4cc63e741", "comment": "Malware payload (XWorm)", "value": "16ee765bb4a8546f75d4376bc4ff7600", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781591188, "uuid": "3577869c-5a95-42fd-b09d-b08bd82897e2", "comment": "Malware payload (XWorm)", "value": "997e8084a7addf3dc57b916e89b93e5270d09d843eda85efb290aa247c2b4c11", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781591188, "uuid": "63d4a826-91b4-4cdd-bb4d-f3351a99f3fb", "comment": "Malware payload (XWorm)", "value": "788cbd00d31ed9a3e41437bca655c0a4772f11c9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781591188, "uuid": "bdc8f83a-2ab0-47c6-8aef-ba7f7a8d1c04", "comment": "Malware payload (XWorm)", "value": "b67148cff82f90d951987cb911b492dbe7645e7dad395b5caf7f225c4203f144cd6786a369e9729d04e05553d4c2cb4e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781591188, "uuid": "8c1aac76-749e-4b1f-a66b-7fe75edb4c00", "value": "T14D958CC68235BAD57C9F0DB674209CB063B45885386904B779BF06832B6F2FED6F0A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781591188, "uuid": "0ca409f0-5bbe-4172-b09f-ef012bf461b3", "value": "768:H+AEob045s0b5Tk05o0to0qf25q0lsZviZvyCCpnPUW:3Jh5sK9Bqfiq0eZviZvydMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781591188, "uuid": "59a96ffe-8958-497c-b1ff-3c79380f008b", "value": 1966246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781591188, "uuid": "3518cff8-1919-4b61-ae29-4523a88c50b5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781591188, "uuid": "494ebed0-3ce7-43c8-8994-5705864f7a24", "value": "goodthingsarebestbetterwayscomingforu.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae8c6d3-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607771, "uuid": "1b3efca9-9b3d-4622-8da1-90894d62d848", "comment": "Malware payload (SilentNet)", "value": "4f33e4c7cc53b6087ad69c2e75ea8d4e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607771, "uuid": "2755e696-58eb-4c98-95b0-a87171bc7b75", "comment": "Malware payload (SilentNet)", "value": "99891906b812e4c48d7059c973166a3ecbda485e028aa37344131e83f5028892", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607771, "uuid": "dacdc618-88a8-4002-90e3-d0ae4e4f0189", "comment": "Malware payload (SilentNet)", "value": "684b1c39c53d15c5dc6d1d816be1531260ed621f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607771, "uuid": "30eea125-f8ab-43f3-b807-ecb8f534d4cf", "comment": "Malware payload (SilentNet)", "value": "1c99b49f5c181510955d902d1116c2304c6d9f422f273d03b7b636295a1b5003b3e166a1688afcebb95b3b6464b1cd34", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607771, "uuid": "28def871-067d-4e10-ba08-7b3dfad93771", "value": "T1929633196CE05945E43FEE31CC599433AE30287F5819A8EA28BC35FD5D4652EEB01ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607771, "uuid": "9bf97dc5-265f-44d0-994c-c0a741fe9cb9", "value": "196608:SiYUbS1ql2Av35Yf1zUb+QdD2+8DG3E0ywwb7bEIpWoqr718y9dPWrcY:MAv3S9gdD2cu7zpWouLZWQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607771, "uuid": "678f1637-b79e-48c5-971e-4a7baabbc6ee", "value": 9002364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607771, "uuid": "1a1211c4-fee7-4f22-b912-0395f661f68e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607771, "uuid": "28805ccd-3723-4973-82c5-e7c7e5acb782", "value": "RadiumClient(1.21.1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8b1748-696e-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1781605864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605864, "uuid": "8f1c4cd5-92ff-4090-a4f3-a7d4072305f7", "comment": "Malware payload (Grandoreiro)", "value": "64ef6042aab4d8cdba23f9dc8ff0f436", "object_relation": "md5", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605864, "uuid": "11875e39-74b8-4e8d-85e6-5797e0ffa2a7", "comment": "Malware payload (Grandoreiro)", "value": "998a2cbd0f0548e0de818fc305963fcad64de1ebcd28e039f43d42af4c4b52c6", "object_relation": "sha256", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605864, "uuid": "52e9647f-29fa-4004-b954-b86d452240ec", "comment": "Malware payload (Grandoreiro)", "value": "f37ee5ecce58e953a4b0bdcfff0567d838eda5e8", "object_relation": "sha1", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605864, "uuid": "b1106c93-c5d7-40ac-947b-17e4fd8913da", "comment": "Malware payload (Grandoreiro)", "value": "e87364eb863d8d4e0420161bc8f207148de61e378c8abfc8b58ed0d4a5a4e0c1528a5b91d7a7246484b825dd54f63318", "object_relation": "sha3-384", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605864, "uuid": "1a97d0c6-c646-4a79-a863-d4010d43daa1", "value": "T11E0206212CE710DDF2775B7427DCF9FB0AA6F4A5642E72B42041C6444BB0AD4DCA2E7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605864, "uuid": "fb06f6ef-a44c-41f3-a600-dd87c5e94fc3", "value": "192:8Y8WI1L2cMacvlk8FP6cDc/X/Jc1/CO7jN0/OVlccMvMhqecrYk0:qWIJ2cMacv68FP6cDcPxc0ojN02VlccR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605864, "uuid": "5e2a1314-8cac-4324-8897-bd457186471a", "value": 8497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605864, "uuid": "defa728c-5e6b-4d11-9215-24f61e2f497e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605864, "uuid": "927bacb2-e7c1-42ab-bd86-83d0d11151ae", "value": "998a2cbd0f0548e0de818fc305963fcad64de1ebcd28e039f43d42af4c4b52c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd322ac4-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609009, "uuid": "d1ffaf75-3ad4-44af-bbd3-757e881f6e98", "comment": "Malware payload (Kimsuky)", "value": "eddf1645d9629376497df77a55357602", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609009, "uuid": "006f0c82-4e4b-4771-bbec-23a67d65d324", "comment": "Malware payload (Kimsuky)", "value": "9a04ee454c586e7e2bf7aaf30830344644961ae9b1bf2093301ee6c404f0513b", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609009, "uuid": "bb777ef7-435d-419f-b02b-7e54c918c8b5", "comment": "Malware payload (Kimsuky)", "value": "bb718db53ea60d8558f012d829f06c7982e14873", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609009, "uuid": "6bd712f9-f775-4037-a0fb-1806ad18eccd", "comment": "Malware payload (Kimsuky)", "value": "fce013f76dccd4009b479299e2bf85edfa46666f2906c32f3c96455d3aa7647cc49cceba396638fa30f9a7af4b01229f", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609009, "uuid": "6b103067-7e48-4960-9943-22f372da047e", "value": "T1DFB2D88B7562D1476E8163F775DBD8C83F0C817D009D07A078DEC6AD13529EC92EC6AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609009, "uuid": "0b2c99d7-5ee8-4b62-92ef-a09ca903cc7c", "value": "768:T6/PBWCE4y0XQuruOAcsQLoiz4+1+gjDpd2Pd4H82UgcSz8:yy05y1s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609009, "uuid": "dcdbacc4-2835-4209-a177-9d9713307e6b", "value": 25207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609009, "uuid": "4b7e4a8f-7ca8-46aa-8460-b3be312b57d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609009, "uuid": "50b71e40-df6b-4688-8158-c21ce025d7d3", "value": "9a04ee454c586e7e2bf7aaf30830344644961ae9b1bf2093301ee6c404f0513b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c187705b-6923-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781573771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781573771, "uuid": "72416625-9434-4d96-a92d-ef53fa26f82e", "comment": "Malware payload (ValleyRAT)", "value": "719a506be56da81969f7c439183ef4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781573771, "uuid": "78ebc898-2a02-4f04-b824-840ee83697f1", "comment": "Malware payload (ValleyRAT)", "value": "9b1250b299fdb88e3ba6b9b3084851b9bcaffdeb202a85b02d20cd9a761af21e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781573771, "uuid": "1bbf7a12-c7ca-4831-9f9e-6dfbc5e7b3cf", "comment": "Malware payload (ValleyRAT)", "value": "3bd86f9c2626a5af34f141c45daac073e50ed004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781573771, "uuid": "855621bc-1701-4c3f-93ca-545e666315df", "comment": "Malware payload (ValleyRAT)", "value": "ba0f65f001ee452cc30d2d544f8778c487f930c3377d88a7b9b8350496246f2f75834a094ea16171893f29ac05dd0641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781573771, "uuid": "280fc9bd-63cf-4580-9b76-6c530b006af4", "value": "T1B7F7D846BB41CDD6F02A9234985B8F90A372FDB15AB083673264372D9FFF24C4EA6544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781573771, "uuid": "48cd4966-b662-4d4c-b08b-4593a3708160", "value": "380560563ebacca1589d8d38ac610187", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781573771, "uuid": "f16bab28-b0f9-4dc7-ab70-9d17213d9b29", "value": "196608:QNnmDA7LpHrqNtqVnAeAqZmBqtiEPFNPyDhCOdBKfoeO0Dh7c2Qf:ApprqN0/CDhrdEvQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781573771, "uuid": "673ca282-0627-401e-8901-a90f66c9c0ae", "value": 76323328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781573771, "uuid": "40da2a86-c18d-47e0-b5b5-dae3ec5e6d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781573771, "uuid": "189a0ac3-2065-4080-b26d-0c59d82f956e", "value": "ainstdownt65561014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd30f3d-696b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781604687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604687, "uuid": "d98eab12-4267-4bd9-87e7-ffd1389e2418", "comment": "Malware payload", "value": "37f735e1872320e40593b9267af30973", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604687, "uuid": "4066e31d-4373-47e5-9037-ad626f31d9d4", "comment": "Malware payload", "value": "9bca5cd3b84bda3618393925ad87bd4f40755c7e3ec406fc4c2d8e526208e3a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604687, "uuid": "147be4b1-0145-428e-8f6c-48b3182f66a3", "comment": "Malware payload", "value": "6a9e564b779efdc7744a7b73853dbcecbaeabefa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604687, "uuid": "d00da8d1-049b-4bef-9b55-e3e7648182a5", "comment": "Malware payload", "value": "7cf5123dcfa94cb38c084b04c98bd47031cbc58696cf0201a05f584d650d1d1060f4bc3c2d78c4032b14e7175654ca84", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604687, "uuid": "be7904b4-0f8f-4129-803c-4624ae80659f", "value": "T12E14B81E6E228F7EF66C873047B78E31975923D627E1D644E2ACC1145F2029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604687, "uuid": "ffad670f-7993-4e02-a163-b6508df3b773", "value": "3072:hd2hoCDrWPyOJ5/xMJKzpnG/6rXB0tlNAjkbvlX3:hd2eCDSP1OJuw/40tHLJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604687, "uuid": "1112e5df-c151-4788-ba10-e3b2c28eb746", "value": 197960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604687, "uuid": "c38728b1-e400-4c09-a336-4849eef5f3d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604687, "uuid": "b6a269e3-11c7-4069-945a-47ab9b51acec", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c83cf55-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623048, "uuid": "f2c2545d-620e-49e9-82d0-033dd0fadca4", "comment": "Malware payload (Mirai)", "value": "b9f38696ff6ba1dfbacc6997c341c505", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623048, "uuid": "59594306-2f52-46e6-8836-925ce6f3ee16", "comment": "Malware payload (Mirai)", "value": "9bcbe731aa5bf08a36ac1c88fb769cdd1733a7d3d73771ee952703b383c6ab2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623048, "uuid": "33e55458-d4f1-468a-9c7c-56ad5b835371", "comment": "Malware payload (Mirai)", "value": "875260f5ae3088630a41b98f2e29faa75ce1a7f3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623048, "uuid": "1091684d-0c61-42c4-90e2-34b79cb17154", "comment": "Malware payload (Mirai)", "value": "87899c34158c951279dad5cc010dec38fb9c8543020b22cebb78fdf30a3ffdd619f91ab723a02b6a6dae59507b426b3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623048, "uuid": "8d792717-b5e0-472d-92b5-63f518bb38f3", "value": "T1D32112BBFFBB8B1AC4A0907B0D6373143630DC5C0024D269BB626A1E9C116257E821F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623048, "uuid": "57e1b037-1bb0-4098-a030-2cef212cec1d", "value": "24:3rXDq3N0yTK69k73MAJBmlhCbjSkvsiJ9lNuNTawqdc:3WVTrW3MS7Dv79CNuXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623048, "uuid": "23cd72d1-29ca-4e6d-9139-9f092f59aa99", "value": 1296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623048, "uuid": "ec9520ec-bc13-47fa-883b-72a46054fabd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623048, "uuid": "00a22eba-b531-4376-88c5-a8e10973f948", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0a7026-6948-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781589576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781589576, "uuid": "5ba37c25-68d8-4432-8da8-21685ed7f1e5", "comment": "Malware payload (Mirai)", "value": "5f58a885fc049a8c17c903908109d523", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781589576, "uuid": "3432a851-60fa-4929-8faa-7bc2e324b214", "comment": "Malware payload (Mirai)", "value": "9c0406f3e62dd5c138f86777224b4e4fd4e423df2d99ffbea37fd08d25c4055a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781589576, "uuid": "7c2e5c65-5e1b-43b2-afc6-ef1a720e4051", "comment": "Malware payload (Mirai)", "value": "fd7fad50b0ee24e229e2bf1b1d2d168071ab50d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781589576, "uuid": "eaf27bb8-6c47-4d24-aa61-971d0aa14eb7", "comment": "Malware payload (Mirai)", "value": "d24c0748633d80eb1846e0d06ec2e46e7372ede6e3e250a90c59b37e777fae268ec9fa0b0e6849f3744951e40fa8bed1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781589576, "uuid": "8aabac60-721a-417b-9e4b-7adb4d229c68", "value": "T19241DBD6600003E68F1BCD69FEAA5CDD460E41EDB15B87B5D7C0C829F85C6A43CF5A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781589576, "uuid": "f3bbbef1-a6d6-4041-b3b4-e3620c7b9b40", "value": "48:a7kt1WnWhn0O2QmUwl/Th/TGZvH301EijIWiKid6x3ttmIEulsn:a7kXWWhn0O2QmUwl/l/a5H301EijIWi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781589576, "uuid": "e5357b79-8fc7-4e0e-a02a-5a47652f3916", "value": 1959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781589576, "uuid": "19f42a72-4402-4892-bf16-b9aa46056ab8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781589576, "uuid": "3dadfb1e-f96b-4284-9c2d-445816457c4d", "value": "telnet.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cc57ab-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623041, "uuid": "da92580c-69bc-4fde-bbe9-8c4f5fbdde01", "comment": "Malware payload (Mirai)", "value": "7065196cbb03edbce5d630ab54f11649", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623041, "uuid": "8d361580-1b3c-42ab-a3a6-12b2b6f0f14b", "comment": "Malware payload (Mirai)", "value": "9d2eafc65908f5b80553b3648b0cf408a21579a97fc3912f5a16f97d504dd226", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623041, "uuid": "28f42c89-974f-4e32-833b-133f172c1d6f", "comment": "Malware payload (Mirai)", "value": "0940ff71d333db71ee59c91a2ded51d3d1c394ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623041, "uuid": "beb6f6a8-ef38-4173-aa98-14b5b502646c", "comment": "Malware payload (Mirai)", "value": "72395b0047bfdf166ae22d6a5ea03a66d561c19794b8686f5ed9114b95cad159c0638c809e2e3325e2544636c0541209", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623041, "uuid": "38402d5c-bdc5-4319-ae3e-d0b9855ab735", "value": "T10E21CE96A7D35D16CC54067BDCEF3710E322AE45869EF453E36212150C3F31A1F2208A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623041, "uuid": "7fa1ffb7-168e-45fb-b31d-68f9beac8617", "value": "24:JhGgP9qD0at6EoWGkrUlFS5K0VzLCkIdhUx2wRGISdXNf6:JhPFqDPtdrkFS5KCzL0IONi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623041, "uuid": "92c69980-5f98-4de4-9ab6-f4d0e8c99413", "value": 1172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623041, "uuid": "8ded18f5-dcdc-4211-81a4-1b1c3749c4e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623041, "uuid": "33cca09b-9a04-4c29-bbd1-57a975260c94", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef22b35-696a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781603966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603966, "uuid": "c5ce9546-d7d8-47f5-8858-e29f7f14a859", "comment": "Malware payload", "value": "6b5269ebb834e15b0a9df41a69aeadbc", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603966, "uuid": "606803c0-28f0-4f27-890a-b8fef31ae7b0", "comment": "Malware payload", "value": "9d78980a066b5403998f58720e3d0a5f2a5c9e7da2ba0a6ffaf2f6b3e5b0fa23", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603966, "uuid": "7b84eca2-7a2e-4163-8b32-c0367f32fda6", "comment": "Malware payload", "value": "f18633ca3d61073af1f302981d139a0fcc028577", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603966, "uuid": "d3f58976-0a8e-4df4-bac2-b18b5b2c4f90", "comment": "Malware payload", "value": "ccc465720addf3e69cd1c89c1cbe25c400c1c745f4aac38742efa3eaff63c2c50652a61c197e7d6a6cd00c2605a91f89", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603966, "uuid": "1501f6fd-7a26-4b9f-991c-c3f0237db060", "value": "T111841E107BD61A21D6388E3954D9F36086B7F101D8F65B2F302C61891FDBA80AE92F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603966, "uuid": "209249b0-22f0-4648-98c0-f182b33cfb2b", "value": "48:5L4wbNDr+yuiv9pIgouCYpq05agJafnIiFu:5HbZSmj1p75a/js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603966, "uuid": "1f5ed11c-3f76-42d6-9318-25220040acdb", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603966, "uuid": "6a758852-15e4-4773-bd89-57626a70f690", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603966, "uuid": "6529b937-ea3d-4563-9e41-e65d753b5cb0", "value": "csic_resolucion_2026.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d215f73c-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606870, "uuid": "cb48a410-54a3-482c-88d8-cbbadb1f20b3", "comment": "Malware payload (Kimsuky)", "value": "9631e2579f8336095b804738d6697fba", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606870, "uuid": "a9c191de-2708-41cb-b875-1a55764d4f10", "comment": "Malware payload (Kimsuky)", "value": "9d9c18650265389dc672ad1630db4b07f5917f913476ac165c145d194ef6813f", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606870, "uuid": "f41c0307-8116-4134-8804-15d0eba3c9aa", "comment": "Malware payload (Kimsuky)", "value": "3a8aebc100763ebe030e53f97b7c7b0ec998105c", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606870, "uuid": "bdee1524-0faf-4e6a-a305-4ba0b184e207", "comment": "Malware payload (Kimsuky)", "value": "2eb9829f10306ed800f42f4fa02cec481607ff69a85662d5c702c5af60642c71232422d7aaf4529bda001a8e883df4e9", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606870, "uuid": "590e3c91-9fc8-48a3-9d44-3d6fb1bd819f", "value": "T142E4129D4925F973C021FB306DF97C0BDA316BDA2413E41905E2FF099EDEA55B08628B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606870, "uuid": "dbe31f03-7b04-4269-92e2-5ee2fd7b8666", "value": "12288:iXcSKsi6dFtjbTUz43IohhxuBkr4WOKm8NnXOXMkIicVWwWLFS/7Ll94V:FxQPTYohhMBFWSueN1cVWwWLFSHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606870, "uuid": "ac7df1fd-e419-4b49-b7e8-68fac78cffb0", "value": 684459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606870, "uuid": "e186094d-5bfa-4aaa-87d9-fb0bb97276f0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606870, "uuid": "28b97249-4e7a-4073-8c67-9e0fe293501f", "value": "9d9c18650265389dc672ad1630db4b07f5917f913476ac165c145d194ef6813f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900b32c7-69d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781649709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649709, "uuid": "369dc9f7-adb3-4e53-a0ed-24c3fac85323", "comment": "Malware payload (Mirai)", "value": "fa094c0b36ef631a41dcb4511bc8a055", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649709, "uuid": "418e1ece-8d56-4939-9ffe-36145cc3a891", "comment": "Malware payload (Mirai)", "value": "9fb6c583aa040bacccce67d22191db8fec7cd708cfabf4da2f1f06ee093962ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649709, "uuid": "afdf184f-6b06-4b34-b625-8b09634244ac", "comment": "Malware payload (Mirai)", "value": "f906451d9d43ed835f52b7857d7a0b620497fc0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649709, "uuid": "476e14ca-e242-475f-b8f0-26324bec62d2", "comment": "Malware payload (Mirai)", "value": "2a3d38e06af349d7a170ccad21f53779d59245d6dcdd3454b91caf18588dba48921255a7f01ee5e83f2d19598be88d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649709, "uuid": "c88fd809-82e9-4e34-92ae-c574e9562de8", "value": "T1F8932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649709, "uuid": "a3926a39-1a31-4b29-b8e3-3494855a5979", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2M:AGUJtkyYEETn0T32TDBf0nsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781649709, "uuid": "2084a97b-fc4e-4ed4-b260-e99e480e8312", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781649709, "uuid": "240126e9-6aaf-46fb-abef-77cfeb404152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649709, "uuid": "3d981d56-5a4a-426b-8328-bdd7fc9f7231", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39bbccd-696f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781606390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606390, "uuid": "d6ba998e-762b-4332-b00f-c4634d0feaed", "comment": "Malware payload", "value": "7b646bb27ef178b53ee10579f28f311a", "object_relation": "md5", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606390, "uuid": "422c81e6-199c-4f34-aae8-9edaa71ce6fd", "comment": "Malware payload", "value": "a047ed6bde51cf05cf22787b1c9a4ad0e26f07d2b286132f4471f9c4ebd774e5", "object_relation": "sha256", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606390, "uuid": "fdfff31f-5706-433e-9868-d19a136c7431", "comment": "Malware payload", "value": "fd69e22ada7f6b430ac3a9512cb587ef1f260fbe", "object_relation": "sha1", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606390, "uuid": "b402a862-920c-4dbe-beff-2a1ee441beda", "comment": "Malware payload", "value": "026c33afb2543cdf914a16629311e7ff16214a2c23f55bf3552b4d7f57879f5718ac133dd74dea30c7ea831088326081", "object_relation": "sha3-384", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606390, "uuid": "37270a84-f1a2-4548-ac02-0243030d98d7", "value": "T1AA56C013B299253EE87B1A36483F9754983B7EA126924C0797F42A4CCF7E5401D3AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606390, "uuid": "75fa8c7f-f660-4a78-b922-8160f79b10d8", "value": "ebf9f50934ebfc138912ce0c5847005a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606390, "uuid": "8f11e0ca-d2f8-4bd0-8aa9-07b3231eebb3", "value": "98304:lIS6/e7gju6UY3Q0YPEgRHTsm+MCvkBpeq/:uSwUY3Q0YPppsm+MCMfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606390, "uuid": "dee379b3-5482-4e6b-9586-934fd8d4bb50", "value": 6017024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606390, "uuid": "2c67b83c-78b0-4223-96ef-d5d2a3d9c78a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606390, "uuid": "3761d36d-8746-4210-9f35-f33b575d3abe", "value": "a047ed6bde51cf05cf22787b1c9a4ad0e26f07d2b286132f4471f9c4ebd774e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58187e3-69d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781649852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649852, "uuid": "5da5ab51-d0c5-4d56-b03b-f6873503f46e", "comment": "Malware payload (Mirai)", "value": "27b7334a17d845e3eaa1df5874fe1b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649852, "uuid": "211a9cf9-a3e9-4d5d-95e7-1e69197c8333", "comment": "Malware payload (Mirai)", "value": "a0e7dc7bd3619f7011a5fbd0ec880ad1c7d95f4a59bd9c88fcf29499dad7de09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649852, "uuid": "ce854b70-823e-4168-a022-307536708177", "comment": "Malware payload (Mirai)", "value": "817e11c06b64401abf53d4081807cf8ae7145047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649852, "uuid": "172c2226-73bd-4eb7-bc23-a2c4ac38eaa0", "comment": "Malware payload (Mirai)", "value": "ca6c59494b832a62c3d60a1ebbce6edc3424e73c25395a9387992e762c22c574f7297b2d10548332c14a3b32d2ad8551", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649852, "uuid": "c27b4a0e-4150-4c98-9b6f-390beb827fd1", "value": "T121B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649852, "uuid": "26ff16a3-40af-42b6-97df-a8dda3de720c", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJq:4azwz102cPPaRl+AS97Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781649852, "uuid": "6b427b0b-e0bd-4295-b73c-969bbef8b5ec", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781649852, "uuid": "0d5e6dd5-22c6-4d59-917f-57707556958e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649852, "uuid": "51e12aa7-0be5-4833-a172-5369537ecc6c", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6268ed8b-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781606683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606683, "uuid": "ff657f64-7e52-4d42-b554-df207ade27d3", "comment": "Malware payload (ValleyRAT)", "value": "8764470af4aee1e3f02d6f3638708344", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606683, "uuid": "970f485f-3e94-4281-aa81-f536c2c96b09", "comment": "Malware payload (ValleyRAT)", "value": "a187330553873191cd11b2823ce9fcee6ba0eae1c31ecb2aace7fecf5280c46c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606683, "uuid": "6429d4bf-34d9-4bae-b993-92512aeec21f", "comment": "Malware payload (ValleyRAT)", "value": "12387e713ce7bf87c33e7c66cfcd7d3271d1627b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606683, "uuid": "9e45ac45-ce92-4c8b-b65b-c15c39f60be8", "comment": "Malware payload (ValleyRAT)", "value": "34d7344469ccc768cac2753d4c8c5b765422217ad27a64b6543d8ec4dd193b7c5870c6fbd1171553ee0d53983f451ffa", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606683, "uuid": "0d57277a-15e8-476b-ac5f-1ef722bf3c92", "value": "T182E6338B72875E75C00FCF749492682F702E7FC1D9789E6672E8B3182D3BA1519B2709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606683, "uuid": "a363fec2-ce40-4913-a8f1-485fc4f6a71b", "value": "393216:HQ4ov0xwyZCvoYbJvwrW+JGhfDWhjo5SR75xS73:w4ovTfodmfDWhjo5kzSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606683, "uuid": "ed5afaae-2f91-40a6-b18c-9af7ffd4f05a", "value": 14352384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606683, "uuid": "c57abea0-1d0d-415a-a77d-46b6bb701ed7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606683, "uuid": "9250cf19-d80e-48e6-8d69-a00cef9651e7", "value": "ainstdown65561009.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d746350b-697c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781612033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781612033, "uuid": "4c23f5f9-3845-4834-82af-cc04b4039f3a", "comment": "Malware payload", "value": "0e93f3012b317576c52391fd040cac8f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781612033, "uuid": "34bcc385-7c3e-4714-a841-5e522a3e195b", "comment": "Malware payload", "value": "a1c20108b2ddb67fd2d4470899e8c952f69d70571c6dc6d404a3e5b2cdc6b3eb", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781612033, "uuid": "ed380647-5718-44e6-91db-634c30d8f888", "comment": "Malware payload", "value": "c73f861dd604e15c5ac66811e4cf124b304c85df", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781612033, "uuid": "e420c836-ef09-477b-84f6-561ee454c4f8", "comment": "Malware payload", "value": "c43194011c4070240098d9517eaed70ab381400ad0f6220af26c031b557399e19e5b2137d857bc2ff680c8125c143eff", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781612033, "uuid": "70839480-626e-40e4-a3d9-e3f942ad0ddd", "value": "T144E57B17ECD208FAC06D623289F296927774BC092B2663D73FA073782E76AD06C75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781612033, "uuid": "bce3be99-7072-4f7d-add5-3d45bf8d6e6a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781612033, "uuid": "22cb0385-68d6-438e-8e33-ab44e531a758", "value": "24576:XsvUlz4Quf1AJLm8Sr+IYYfFL1zIUpJ7Y+qdI6UVDLPDuhOYOtOCkNvA2Bele5IC:XsvE8P1T8yXNF5JgdkfxYEO6Z6WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781612033, "uuid": "2402437d-9a10-4c9d-b63b-42ceca54a31b", "value": 3316104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781612033, "uuid": "6c0f9fc0-d53a-4f0a-a0bf-af59589bfe32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781612033, "uuid": "dac5dccb-fba5-486d-9261-57ccd09196f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b6c86c-691f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781571869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781571869, "uuid": "ca0cb7ac-940d-4e4e-a039-282eb852e98f", "comment": "Malware payload (Formbook)", "value": "60c6951eb4cdcc8531f5d0bae1b284ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781571869, "uuid": "0c302300-7a4e-402a-871f-e090b40a307c", "comment": "Malware payload (Formbook)", "value": "a1c41f9aec30973dd26c896128015649a055b2c7a59e488b66bab1f30816ff1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781571869, "uuid": "6610639f-32ab-4b73-9dc4-0e542eb7baea", "comment": "Malware payload (Formbook)", "value": "3f3296b5eb56f7e922bf3be2a1089d7e854f6c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781571869, "uuid": "0b6ae652-79a7-4aa8-a546-3dfa75061465", "comment": "Malware payload (Formbook)", "value": "1bdcb89cef387231e4724b3cfe2ae75564e0a73a586d1a0a312d68b5827629ad64d812555f03e806a0dd9699ab90bbac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781571869, "uuid": "bbcccdc4-9c03-4495-b3e8-c6114d1d697f", "value": "T1843512182326C747CA5043B90AB2F2750BBE6D8B6922D30ACFD97DEF7925F448D12653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781571869, "uuid": "82ab2555-d9d8-4d9a-8c19-4eb1a6d4aa45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781571869, "uuid": "eeb0d708-f314-45cc-bf6f-ce14484a3ce4", "value": "24576:20dz743vDN6EqEmjrBTJBQRaa6Cmx4XgyaSz+:zGbqEolgLmWXwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781571869, "uuid": "a389bd8d-2ead-45a7-8e69-fff4acffbf85", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781571869, "uuid": "282456a0-09b4-482e-95be-b2f3113109e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781571869, "uuid": "67aa0eb9-156c-403f-838a-7fb7160c80f4", "value": "PM114079-990528pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964089ba-6965-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781602045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602045, "uuid": "9a9d8db0-50d9-4624-91c7-7e5d6b92d700", "comment": "Malware payload", "value": "954e3abc3cbf38a6effba1bb89653e63", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602045, "uuid": "6e51e989-09d6-45af-9438-4738063ca8f9", "comment": "Malware payload", "value": "a2ee7ad6005106dae5d68f960c54b186bcc65fa5c4758b9b866b5a35b3540686", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602045, "uuid": "cdea3e8c-0549-4a54-9bb9-b4b571ee8202", "comment": "Malware payload", "value": "0793f55150ae9132e2c9896671cbd81cf9e1db19", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602045, "uuid": "866a6300-cb94-46be-af43-1b15ef2cf0b9", "comment": "Malware payload", "value": "723c3e3a8eb69ab725726065a3a084b88c5efdb0bb1a90421a77b91a83407e558c0f51d50c9cb8e72f4a8a7889ce39b1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602045, "uuid": "2f066bdd-7359-4aa2-bdcf-66da60265a1a", "value": "T18641F7183DE90235E3F6DD7685BA57154426760AAC39CA0D44F18F4D1815B03EB7AF1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602045, "uuid": "b8ede4ad-8614-4aef-ba9c-b2819896bc60", "value": "48:85SRLowQLaz3uCwQSpz34w21C4HKGLy3G8c4jCyjMscSbdE:85Stz3ulTN3fVwyW8NC0Msj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781602045, "uuid": "ea09707f-2eb7-4110-bfd2-632813ce4aa0", "value": 1917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781602045, "uuid": "d19f1ce8-0795-426e-a0d9-f4217b9b6cfe", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602045, "uuid": "9c93cd1d-faa2-4366-b848-30471cc9252a", "value": "doc903947.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfed593-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781607508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607508, "uuid": "5b4c1908-e048-45bb-8617-ea4e28764371", "comment": "Malware payload (Kimsuky)", "value": "836326431c5dfa9d5ff56ca649e41df8", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607508, "uuid": "0f0ee039-3b15-42e8-8c30-8e7680fa1fa9", "comment": "Malware payload (Kimsuky)", "value": "a31d57458ede2bba3b4fcc2c5d9b7fa5e511ad4086f47d9b504ea87ca47d119f", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607508, "uuid": "a69940df-c887-498a-96d2-06c68327740f", "comment": "Malware payload (Kimsuky)", "value": "32ea048d7ceebce80e1b427bcbf13fcd9af8baa1", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607508, "uuid": "f2e59de1-9fb0-491c-8e68-7036e318ac4b", "comment": "Malware payload (Kimsuky)", "value": "3b8359acf7658a1dc7c35002258cb3deecf43ff386fa282d3697d84d2003f693cf4b0835c35d9ce85360d409a79ac09e", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607508, "uuid": "86eca27a-b465-43b9-a7a4-ddca1ca27b8b", "value": "T164A208E2B312C3CB7689938B22AFF88CBB048575015B55A0FCDF4B4E139B98491F5A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607508, "uuid": "7bbfc8c2-66c2-475f-abe8-56e92796e9d0", "value": "384:zb1H9HvHe0RNocfukVY6ba2/hSApa3KGqKvyvlebK5bWMd5rM5bpYUR+WSkKeEcF:zb1H9HvHe0RNomuAY6u2Na5qKvyvoKVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607508, "uuid": "0613ee0b-225b-47d4-9db1-8efd1be59655", "value": 21745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607508, "uuid": "c61b69d7-dabc-44c5-adc8-3528ad7794ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607508, "uuid": "aae6d8d4-e618-4981-a62e-5a6ac63182cc", "value": "ahzj2uew.lid.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebb124f-6969-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781603858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603858, "uuid": "9bdf80ff-617a-4c1c-a021-94001684dd5d", "comment": "Malware payload (ConnectWise)", "value": "7efc3d83ce8f54d93966930c0a8b3316", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603858, "uuid": "995cef92-160e-47df-8057-46f0f689d698", "comment": "Malware payload (ConnectWise)", "value": "a4018431ceef5951f42ba74ff9a78db54d43030590b1ade030136227eee9035d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603858, "uuid": "b48d80b9-2478-498d-a2e8-c63dca9ab433", "comment": "Malware payload (ConnectWise)", "value": "039599f14cb1ff9f6d9ea7d5cd671b05d5690337", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603858, "uuid": "1faa8103-631a-415e-baee-3b4be79de97d", "comment": "Malware payload (ConnectWise)", "value": "12b32bb020ecdb451de41ccec1976d42d11037ba7f9bebcddb40cd32fb04ba85ec96e4f01083368f5db2057475c058c9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603858, "uuid": "7bf56012-e998-4645-8589-c12a167b5e33", "value": "T1C4646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603858, "uuid": "c0cd0a2c-cd85-4245-96cb-c0e9a3162d61", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603858, "uuid": "3b5d70ea-63b9-42bf-a968-dd920ab3672f", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9cPN8:o1iw7gryNkSV1hy1Z1u2JLa9cPN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603858, "uuid": "5a2d5468-c6bc-46f5-b4be-b55dfc3e7bf5", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603858, "uuid": "ab7c13bc-cd10-41a9-afad-a76d13df6529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603858, "uuid": "818d658c-8476-464e-b52d-9065c550da63", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8a9fc4-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623044, "uuid": "06273d7f-0aa9-429f-aeed-44653bd0a909", "comment": "Malware payload (Mirai)", "value": "f16fa1578be2701020ce06390f160ae2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623044, "uuid": "751520c5-7395-4773-aca2-9794c314c02b", "comment": "Malware payload (Mirai)", "value": "a509b579dc1edc5a662025df93f850e78ad876783cb139b31e3fb9885a4ffd1a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623044, "uuid": "d13be1e7-ab87-4046-82f0-1819f5242a1f", "comment": "Malware payload (Mirai)", "value": "9efabb6e069042471bd99fd13f38ff1ae79e7993", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623044, "uuid": "d74c0f94-b7b2-4796-9683-f59e1c28f236", "comment": "Malware payload (Mirai)", "value": "41dff49881825917b6d50765b0d5fc7df1c09b4280395a760410b7b6c0d47f23048f3f18115a4acbfa070baf55a7e5a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623044, "uuid": "9423ace2-ea56-49ab-ab85-c00b7c6a9dd4", "value": "T1E1213EA292DCE932C72200FA5286BF860760CDA1252BFF0B8D911812EE391D0C133339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623044, "uuid": "a45ba0db-8e75-4aa5-85ae-389407671523", "value": "24:FlGPMAqGFHxgxk2ZO4l2ZWZidwvMEnaGu92/4XtruQYqXNfc:fGPxqM5wOewWZidwkEnah2/4XRHNN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623044, "uuid": "d90be27a-026b-4e4e-b54a-6b18e3a6d60e", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623044, "uuid": "cef32533-1c58-49b3-94a3-c24818131b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623044, "uuid": "c7361122-7e4c-4bce-8116-cf6136d51d24", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f914d94-6976-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609255, "uuid": "0b745897-d7c1-4d25-b5a1-3d6859fbc6e6", "comment": "Malware payload (Kimsuky)", "value": "de83989b47a6bdadefa5b1f4bf2f39d8", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609255, "uuid": "96787346-4a9a-4a0b-8a98-f75d9f82ee64", "comment": "Malware payload (Kimsuky)", "value": "a557cb887387188193688381e46f9abc27fc5d374b23aaa8f24dafca3934e590", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609255, "uuid": "2c34923f-7028-4ddf-9b18-c94483d9150d", "comment": "Malware payload (Kimsuky)", "value": "6c076b38c2114afe4914fc486d966714fb0d1481", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609255, "uuid": "014aea66-31b2-492c-bafd-a100faf28ce0", "comment": "Malware payload (Kimsuky)", "value": "2b43b7b677c4c995bc3cea57d4d488e0c3e69122286dc0e96918c65c887adbd9c7e6109b7df7c7a26cc801e317a138b3", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609255, "uuid": "647d5ef0-81be-493e-af1e-bd7a4441a8d7", "value": "T12D91D797600AD39B2387854BF2CFF988A708C9BC00AA9DA4F0EE5B1D1350F5915F996D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609255, "uuid": "e3b3a9ba-ec55-44f5-8822-f407b6d41668", "value": "96:iD5vwxkKnHu74A19Jjh0cnI7bdcvpZzajKq9cD30hpny:iD5psH+FngWuKq9cDkhpny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609255, "uuid": "4448e94f-fa54-4d1a-93b3-ccca89f271f1", "value": 4322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609255, "uuid": "fe0d8255-bfc4-4a1d-ab46-5dcf8afc7db6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609255, "uuid": "f6ad3f0b-9a46-46d9-a6a7-6d34cf6de880", "value": "a557cb887387188193688381e46f9abc27fc5d374b23aaa8f24dafca3934e590.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca12865-69c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781642670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642670, "uuid": "0376389f-c575-40fe-a339-2594ae356a91", "comment": "Malware payload", "value": "164a7c07a57e5af5c99bee86df627d89", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642670, "uuid": "b1522825-68b1-472e-9ee4-d16432f7336d", "comment": "Malware payload", "value": "a58fcff70e01b8ff93c2eb359a279c3a9d6bf5d2977b843df190fa39686153cf", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642670, "uuid": "2bda16c1-0f25-4719-8173-958f64008e90", "comment": "Malware payload", "value": "8c7ea2cc07a3f50f0b4a0cccbd7726d4d730b62e", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642670, "uuid": "6c599037-bec8-411d-ac4c-4d911350180c", "comment": "Malware payload", "value": "8093b906ebdec62346e0e33574471bd6aa71a5fac28c16d460c34f269bdfc2e01d4ae9d0fd0e38555aa84a24f2dcd3f8", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642670, "uuid": "576a633f-354f-450f-b113-79a5bd3ec35d", "value": "T1D656AE0BAFD80992E18DA17109BABA11737478951B2327C32B64773D3E736F0A9F5B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642670, "uuid": "72b7cae5-5f67-4be2-8fb9-8a8a139b92d9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642670, "uuid": "3139201f-ef28-41f0-a4f3-bc1ba721c98d", "value": "98304:YH6EGEXHmgodI8N09MdU98NU9UuLEQZgA6Jr8ry6mRjHHHHHoHHHHHPHHHHHPHHs:YKEXHmgodI8N09MdU98NU9UuLEQZgA6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781642670, "uuid": "98d452a0-54ef-4835-8bb9-4d9ff9b8b115", "value": 5894008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781642670, "uuid": "8dcaedbc-132c-44fc-b695-7f407552f273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642670, "uuid": "ac19311b-88be-4dec-a00b-f995d80cf314", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f990736d-6998-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781624116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624116, "uuid": "85f7a0ca-11dd-4681-bec1-0a6e6e01e654", "comment": "Malware payload (Mirai)", "value": "aa471f178431e3659dd4de3b44ba85be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624116, "uuid": "037afe1e-f0d6-42a2-b43a-76d78e1526c5", "comment": "Malware payload (Mirai)", "value": "a59cb5dc8612528db50d9dd3bedd20bf6b4f8dab2f886a402726196e395bf3d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624116, "uuid": "9b4c225a-2532-4e34-b6b0-82aebb412670", "comment": "Malware payload (Mirai)", "value": "62c792995e288ee8a1ca7f50af211b1779baff43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624116, "uuid": "9c036558-6907-4ed3-a6c9-ab91489a7be9", "comment": "Malware payload (Mirai)", "value": "3d4a7770f6d3e94b14e88fbdd96e567750fb58499539a4a1d2a5be7223c0faf01e3b235f8baa80d2f9a496f81f572293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624116, "uuid": "4433216c-623f-457f-9fa9-7b9253492166", "value": "T17563029A99941B5BF039CA3D0AFD252F1890C84FF98945BFBCE8A436C6897314F14DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624116, "uuid": "211859d7-b77d-4a11-ba36-c2fa57580a15", "value": "1536:bO4KApzGgV5QPzPyye6e2N6sZYWkcYqbn8uWcDmnouy8ryn:bzhIDyM6sZY3qbn8uVWoutc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781624116, "uuid": "aee26b0d-5391-4ded-8b5b-383c345e0c08", "value": 67720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781624116, "uuid": "5ec81fa9-fe07-41fe-af5b-acc4edc4a7d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624116, "uuid": "87bd3566-9ed7-4a27-85d9-98522a2116f7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1f8b1e-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621862, "uuid": "cf569b70-633c-4097-97b1-d3b433e38c6c", "comment": "Malware payload (Mirai)", "value": "175efb045b0d4df75d78a913b8c053d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621862, "uuid": "fb07fa97-b133-49cd-904b-2b6871b9f1c9", "comment": "Malware payload (Mirai)", "value": "a7f8c37cb9f824db95328df43f68765f3679838ae356e92f798983172d4a85d4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621862, "uuid": "95e6bdf6-dd6e-4da1-b11c-5ac68cb6fc94", "comment": "Malware payload (Mirai)", "value": "1b807f1a573b4a80b3382faaaed7006897ffd8bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621862, "uuid": "ebdec5fd-ec3a-4f1f-b2cf-91f61bc52084", "comment": "Malware payload (Mirai)", "value": "ce54a3e2d6177e112ef6a2190cadbeb9ef87e92e63a8124dfec993446e583f3a99c1117ca1f1b31a1f885fcfaeb3d5dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621862, "uuid": "412776e5-b02d-48cc-8487-ec492c3fb9b9", "value": "T14611089C299D2A7A4A22CDD5F4B39526B12FFBC432573B28E748763A5C985003531BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621862, "uuid": "8e9c6444-78fd-442d-b692-ca7576866d9b", "value": "24:QvQhBh9M0oyCtiqtcRtKt6iJt6KdtGJOti9tcstdt6ikt6KwtGJy:QvQhnoINiaytihB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621862, "uuid": "12c2a2b2-741e-44e4-9f9d-f52afcfe98f1", "value": 1076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621862, "uuid": "3f176e27-978a-44e6-957c-2e91f86d4ddd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621862, "uuid": "c79838b0-a7fc-4614-bdf3-e6efda317151", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f41a979-69a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781631051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781631051, "uuid": "3b862f24-c66f-4470-be95-acfda5966cbd", "comment": "Malware payload", "value": "c917a1cb82cdba34aeb74ba8059fe881", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781631051, "uuid": "81e41726-1872-4baf-b94b-2805bb9023df", "comment": "Malware payload", "value": "a8344d93e91740240ec6fb9d08f4bfb57c59e9252306383edc3a79e4d96272d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781631051, "uuid": "0c40ec87-90cb-4cfe-a3c1-a859b44f59a5", "comment": "Malware payload", "value": "33772e3a9e4c8ba7767a543098505f1509ecbc03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781631051, "uuid": "a7a2d6f4-7595-4196-84fc-eed183829f1b", "comment": "Malware payload", "value": "d070e1b8b6dbda56fabedbc51fab4e754e2bcf9ed96fb8f742fd11bad13522d2ce6912f09b72d09f71da463847b3272b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781631051, "uuid": "e73cc1ee-84cc-4e7c-80d2-38bc670db243", "value": "T17727CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781631051, "uuid": "cecb4739-8fb5-46c9-9027-cbd16a9dc14c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQL:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781631051, "uuid": "cb439408-8a33-4810-84dc-9c033bd2c7c2", "value": 21626880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781631051, "uuid": "9c74d3f8-b3be-4203-8ac2-4a4c243c8f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781631051, "uuid": "8924f2ef-63f5-49b5-a002-46d7b846f373", "value": "a8344d93e91740240ec6fb9d08f4bfb57c59e9252306383edc3a79e4d96272d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b506d6-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609030, "uuid": "9e5ce0fa-b1da-43e1-8caf-f3c52479a5d4", "comment": "Malware payload (Kimsuky)", "value": "e1bcb989412a4127124437fa9df11da5", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609030, "uuid": "b2524b55-0ece-47b1-9f7e-a6b5f75353d8", "comment": "Malware payload (Kimsuky)", "value": "a8429c132a8ae534896f91d4c5e716d2b751ed8490f016af644da21857bd1d29", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609030, "uuid": "85fa1887-c6f7-4955-8ac7-642c597538a3", "comment": "Malware payload (Kimsuky)", "value": "baa9849b19c384d904a8bd2c82245c68820b8ebe", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609030, "uuid": "3cafe7d3-6f7f-4c2b-ab4d-d454f2f66524", "comment": "Malware payload (Kimsuky)", "value": "33ea8a625c9120c653ebc4af2b21f5caf7df8d64c04c638861b1db4d9078d4443b52550af986926e5a2fa301551606f2", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609030, "uuid": "ac512fe8-c79c-49bb-8b7f-1bb99aae5f13", "value": "T14592E6E6B252D7CA75CA8287A3BFE8CC3F0C80B5025B4560F9DECA4E6316D0445B6E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609030, "uuid": "d04370a4-8d42-46f8-8ef5-51d8f768dd69", "value": "384:cWZrdVL066+NH1sJ+N76lexZhxBjDnyGuuV/Npx6iDciobCoPfQapelV9l3n4WjA:VZrdVL066+NH1sJ+pYwrBjbyGLtNpAXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609030, "uuid": "c4e79bd7-28cb-4c80-b5fb-5b8b4a74c01f", "value": 20535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609030, "uuid": "d1c88220-2b78-43f7-b887-fec59a7004bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609030, "uuid": "fcb97d51-f588-46ae-bf1a-24e6ae170ca0", "value": "a8429c132a8ae534896f91d4c5e716d2b751ed8490f016af644da21857bd1d29.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31733304-697c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781611755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611755, "uuid": "54ef7384-cb74-4ce9-a750-1a561c6ef5bf", "comment": "Malware payload (RemcosRAT)", "value": "1975e4f3098dc2eb0b8f6f46e8813f3f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611755, "uuid": "62d84927-552e-45b3-9bba-23c0ab9b9ce3", "comment": "Malware payload (RemcosRAT)", "value": "a84724da7ca93094431ce7ac0aa49e10c7cca37f6accf972fea702270887c25a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611755, "uuid": "d02b179a-fddb-44fe-8030-4df8fc66b079", "comment": "Malware payload (RemcosRAT)", "value": "0c2a9a02a78d3e369b85278f472a49fcb542b3fd", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611755, "uuid": "9a39b0bc-a54a-413a-b360-e6ac3e1a184b", "comment": "Malware payload (RemcosRAT)", "value": "fe7ae959ca7553163aa35db02eef23488453d7097117332b31c349d958024f03e2bb844aa68149c162c2b0c9a339d9b4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611755, "uuid": "3b4c2a70-91e6-47ce-85d1-0275f6031194", "value": "T1EFD40251F295CD0BDF9A4F398BD3D7E61200BCA19E2A860F6141735E2EF36A15E03D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611755, "uuid": "6d291d57-ad08-4e96-ab03-e7fc574b2097", "value": "12288:5LH4yigti9PQvUJjS7YsM4g69kbE33AH4:5LHvigs94vU07sqkJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611755, "uuid": "a82cec25-3406-45bf-8536-c57d8e0286d3", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611755, "uuid": "af609e8b-3bc1-43cf-9627-82074c38f75f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611755, "uuid": "00ee075c-65bb-49ad-9bb8-70851b29f512", "value": "Order list 7027521.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cf4038-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606846, "uuid": "1470a874-2279-4d65-bda6-d7fb8e1a7291", "comment": "Malware payload (Kimsuky)", "value": "5aeac893fc7d154f000e286ce42b68af", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606846, "uuid": "80f2ff9a-6673-4d2c-8ed0-ce6ae3ab5233", "comment": "Malware payload (Kimsuky)", "value": "ab00f7c45d48514a8742b2777bcd03e0d6ace318b3c53022a1ec51757ff65132", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606846, "uuid": "f13a09b4-7b25-423d-b0f1-0f77044bc6e9", "comment": "Malware payload (Kimsuky)", "value": "a58fb7d6267c216acab0bc0c0edde13a370ade05", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606846, "uuid": "8327dad8-08a8-495f-bed1-5042ab85812f", "comment": "Malware payload (Kimsuky)", "value": "12c91b9040026f4a12246da8f3a89d90bb46b3dcd177c045ee3b696843b3b2afe17135d1a1f35fbf3b31315c1e5c12bb", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606846, "uuid": "6039a36a-d9c1-42d9-b13b-88bfac24038f", "value": "T125A35C2D6575D997C238D7A2DDC2CD9A759A1A03322A6C3C34E34F8D09127A67EC132F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606846, "uuid": "2446502c-df7a-4a62-b722-7fdb65cefff0", "value": "3072:tUt5tGETuWXkILH2tgdIS5OHajmfbxqFTu2YYT:7apLH2IafbxMa2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606846, "uuid": "b66a62db-37a4-4d29-8b23-c1493f3a67f7", "value": 99008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606846, "uuid": "303cc024-00aa-47b0-9623-bd9f2bdc8520", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606846, "uuid": "6443b2ad-c1ae-4220-accf-852592342c22", "value": "ab00f7c45d48514a8742b2777bcd03e0d6ace318b3c53022a1ec51757ff65132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c55e0a4-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625597, "uuid": "18d05716-7da9-478f-a3f5-7e367c9cc2af", "comment": "Malware payload (Mirai)", "value": "0a21ae10d796c49b02bd47149e269073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625597, "uuid": "f7bae745-e3a0-46b3-9c1b-4e4a18d4fd5a", "comment": "Malware payload (Mirai)", "value": "ab9595e8292ee3c3df40a28815641b73273a2914f83dc8b5d43e70481f2c414c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625597, "uuid": "af7a270a-9cfa-4d5b-a508-c5a61df0c554", "comment": "Malware payload (Mirai)", "value": "2041fc8a7200855c69c4dc7556fd235d2e73c0e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625597, "uuid": "a8b74be4-9134-427f-940b-ac16287ffa7b", "comment": "Malware payload (Mirai)", "value": "84b9031b5f34b3f7cbf89a080ebfcbf6c817ab0ba481e13d25380796ef9f9d2d477606ea0c10a808ee199d8b318608a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625597, "uuid": "745fa874-4c43-44c0-a67b-043d81e71b9e", "value": "T133133B42322C0E17C6A65AB0293F57E093BFE99020F4F688255F9B5A8675F371186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625597, "uuid": "85aac08f-2cdc-4a5e-ad13-73130c236ab0", "value": "768:MkZlh8lIx/ZNHU15aDNfVDR64FYGuChBDYI60Be3NsL6Tnk:ZNxRNHU154dJxh5dlGNuWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625597, "uuid": "ea62306b-1d22-45e2-b038-2a45456c2675", "value": 42220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625597, "uuid": "ac358013-5cf5-4d4b-9729-c7438e46009b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625597, "uuid": "f62bc5b1-c1bb-4f1f-9cd5-7458eb31d2b3", "value": "5f0ed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7592bbd-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781608651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608651, "uuid": "97ccf6de-f217-41dd-9a2f-4867c4fa6985", "comment": "Malware payload (Gafgyt)", "value": "0addd1935a4ac18e0f2061856e596b8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608651, "uuid": "322ff0df-67fa-490d-8b63-d54ed82f6bd6", "comment": "Malware payload (Gafgyt)", "value": "abd7274576a4f121c69fdbd33e758f4d848333f8db48a3ef304cc7bdffa82c37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608651, "uuid": "e5b288b5-d840-4d61-9a2a-525797325886", "comment": "Malware payload (Gafgyt)", "value": "8ffbf0eea5ef88f02725f04be56b5b2e839632a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608651, "uuid": "d36e1b36-d6b4-4a0a-ae8b-c5751e96fb07", "comment": "Malware payload (Gafgyt)", "value": "4239b65a1b2bffacb3f544e62cb7bb642e0f7a6eb563c9d963baab30c61c7ef48771d619acbd652c11425b55d98aed7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608651, "uuid": "f3cfee4f-9832-47ea-b4ee-41a69f3c6dca", "value": "T1B574A623D8154955D1614CF322273389AD0B87BF89E732D3EE2A59A0BF6051F52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608651, "uuid": "90a0146e-59d0-4f2f-9ecb-22676a097e83", "value": "3072:/bcQJnSFPMx1ZL+gKwjoCrDtOsamUJCmy4ylQCCW6i8zNb:VWMxf+/wjoADtO7Cmy4ylQCCW6i8zNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608651, "uuid": "d82f8868-bc76-4f64-a0cd-5e9325a69053", "value": 356827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608651, "uuid": "09a0f19f-2b4e-4989-b3a2-a9e61909f0e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608651, "uuid": "48f57e85-6b18-4deb-b2e8-363c9aba428c", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90cdff7-6958-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781596493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781596493, "uuid": "d6885c42-40b5-40fc-90bb-02aa83f2061d", "comment": "Malware payload", "value": "060a6f8e4b06ac88eeea3d1ad41904f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781596493, "uuid": "3c5a84d1-48b4-48af-82d3-bcb4ba0732a5", "comment": "Malware payload", "value": "ac2ee3bda0a9616d27341b36e0bae58c61515cf99208ec3251f93ae30f955889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781596493, "uuid": "8bffcfdd-df0e-4870-bafa-c4b0f71556e0", "comment": "Malware payload", "value": "ce6f4d7de05f106757c604c42bcaf74453ef1dc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781596493, "uuid": "6b7e5b1f-13bc-41b6-b2ac-c66f7bbad085", "comment": "Malware payload", "value": "756fdf98ccefef575c0800c9ea5583d4bd27a5a9c02a151ec87bb29c5970d1a99e7bd5530140b18f492666261006931d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781596493, "uuid": "f4b50124-aba2-4eb3-871f-e1e4b6b776fb", "value": "T1CA847C91A7F5CFA2CFF1D47F01D64BA14DF9FCD30B209C56E2B5672A4B21092262681B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781596493, "uuid": "69a69a6c-db0d-47fe-ac97-a920d9cb2413", "value": "1b461ed8d73479867e75976e9550dc52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781596493, "uuid": "2b90e589-4220-4799-85e3-10e8c84396ca", "value": "6144:RTMcChJsP39HyOvmDy8uI346njF2ISjl39NHu6Beh:NMcCiyOXbbLBeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781596493, "uuid": "b268bca7-fc41-475a-a353-734b1700ed30", "value": 401216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781596493, "uuid": "d0babc98-5481-443a-b4e0-2dff7a4e21b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781596493, "uuid": "5d3e1e1b-5549-43d1-ae6d-6bd881d14cb8", "value": "____.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ec6f7e-69a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781630772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781630772, "uuid": "f35a34c9-567d-4fb4-be80-03d6fcb3f9f1", "comment": "Malware payload", "value": "5334d671a44488564cd497c0b46001bc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781630772, "uuid": "54a2334f-9b48-410d-bf73-c67cbcf1fe0f", "comment": "Malware payload", "value": "ac749f9dbf057765ac25ac6220be614a3601fcd716b9d1e6e971e50929c680f1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781630772, "uuid": "d6a70dcc-56bc-420f-8462-03c72d646748", "comment": "Malware payload", "value": "7c86dc805a2b1e144a86897f308928f3f5fb917b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781630772, "uuid": "b07351c4-1a6a-41d6-9430-13b18ca457c1", "comment": "Malware payload", "value": "562deb070c6178215db59dbd4af2227e642f566fbc3f55c08e4be696b5a2afdac5963917a41fe4f20204d870d0d1aa83", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781630772, "uuid": "ba86687e-cf62-4369-93c7-8c92ad9b9fb9", "value": "T1FB168C03FD9608EAC5AA62318AB345877776BC041F3227D32E5073782FB2AE86D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781630772, "uuid": "2f14e862-3850-4cf3-b549-83279ebbcc58", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781630772, "uuid": "686e734c-92e7-4189-a0a5-8c0c01f0801e", "value": "24576:YIKUXpFdfnSIBYEgvZ6Myi6lHYEwIwpFlzGDmJ1R3MkuhXied+SMbAtvA2Bele5I:YIKep/fDBbO9yLretr1nxZ2Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781630772, "uuid": "56ea3ed8-6cab-42a1-9035-96d47cbe41c3", "value": 4366712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781630772, "uuid": "334e5e7f-728c-4204-8fa0-7fb79fdad07b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781630772, "uuid": "ff8eed6f-7f28-47d7-b3d2-5f86c0319762", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f13c0605-699c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781625820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625820, "uuid": "0a504b4d-4ff0-4233-a942-04b2b60be70c", "comment": "Malware payload", "value": "0ca3c58baf873ff4d2b68bb9bf7ef226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625820, "uuid": "7fb95af9-19e1-41e2-9853-a16292083393", "comment": "Malware payload", "value": "acdcb9c983097692f5c05f1a374122c198cb6cb8f7901e34e08969db2a4e4f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625820, "uuid": "b1040d23-1397-4082-939b-efd5bd72d1ec", "comment": "Malware payload", "value": "e9ad59b7e17cab1ad193e520066bb0713b0f340c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625820, "uuid": "ee128ba0-9450-467d-9090-2eb091016adf", "comment": "Malware payload", "value": "c3b97803fa4e3681ec99696bbc21aba090b8928aabfaea1491e8ee19e133b824ec29fe3c847a5fd95d1a90e94d51e284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625820, "uuid": "2f2f2e9b-2d78-4687-b5be-d83c583a1047", "value": "T1C106A3610394D632F3246B9D1679BD24640E588B58FAEB0135AED774323DC33A37A7E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625820, "uuid": "95a7be25-6e55-49cc-af36-e46c33d343d6", "value": "98304:dGzU82cKb0dZ306JO94EktvF55tzj9FHtz8wpbv5jNliPzMZ25gxDks+I1tHFmaA:dGzFKb0dZ30664LPBTHtz8ebv5SMdxCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625820, "uuid": "9263cbdf-3a46-4a1f-b5c7-0b2eb1bf2a04", "value": 3764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625820, "uuid": "26756e46-692b-4573-bf14-2b77028cd76e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625820, "uuid": "e7a8b2e7-97d1-4234-b548-e3c6537bd48f", "value": "Confirmacion de pago_6162026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795ca575-699a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781624760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624760, "uuid": "18ba4a52-92ee-447e-8e8d-6438ac8cc162", "comment": "Malware payload (Mirai)", "value": "0bb6f07054f3f783fbcd0a05b45c0dae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624760, "uuid": "d08a9006-426b-4686-bdd2-04b9fc9acc66", "comment": "Malware payload (Mirai)", "value": "aedc3120dd7be8cb7336e8e6ed9b31fcdc01e10bc51e3491053858a4d403f001", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624760, "uuid": "1dad3c90-5125-4483-94e3-27a7f98a6d4a", "comment": "Malware payload (Mirai)", "value": "e295138a362a09242341cc408d8ec5465beb5109", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781624760, "uuid": "bfb1030e-57d5-43b3-b306-0ea7a7c9face", "comment": "Malware payload (Mirai)", "value": "3c217ff08660789093025038b080798ddb750cd1d355e79cdc1fefec6d2d4ff9f26bdac303a7380810dfddabebf20fa0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624760, "uuid": "b1631c8f-b8be-4210-9879-6641247ac1a0", "value": "T1B721F3C4129358707CF54C2BA26AC918F5C97A8AEEC14E40A0DDF5F5A4CCF49F901AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624760, "uuid": "8d8ecc5a-87ce-425c-b5d9-885abae4dfab", "value": "24:IrrHRKhEH8fEHHsTE1hjXcU2VWZrXcU2wWUrXcU2AWkrXcU2FWJl:2RKhEcfEnsTE1hxcolP31kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781624760, "uuid": "b0aa2b99-d464-4b34-acfa-ed235fc5cdf6", "value": 1382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781624760, "uuid": "3dc59eb7-1095-41aa-aafd-73e70f65796f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781624760, "uuid": "7369abd7-58df-42f1-9ab6-8385dd3baa91", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd8bacc-69d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781649138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649138, "uuid": "12c1d0ee-8297-473f-9b65-1271d15e5bf9", "comment": "Malware payload", "value": "6933b222e19f0236e23c6bda03a24c10", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649138, "uuid": "8b12f9a5-07e5-48f4-81d9-51795272fd8e", "comment": "Malware payload", "value": "af1e4e322e5b463174febf86b0f8503ce89385dfc94671de61ece1f1c92a9065", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649138, "uuid": "e3be1812-0dd2-4d69-9c9d-9ac93a3a4306", "comment": "Malware payload", "value": "8a668cd30a3af2d4467434724bd89500a2068fc3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649138, "uuid": "e427cc9a-1704-483e-b1df-bf70518c908e", "comment": "Malware payload", "value": "b0ee9613f20382ff5b469b425f38647c97def146f912df651ab50db9bfa605a42a497a1147a26d5ffdf1588f51f5144e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649138, "uuid": "f35cdfa8-5589-4248-bb03-f3d33c11b55d", "value": "T1E806F63CCC59423EC1B3C92CC98A4A0FF9926907223DE94B50D7675B5E27583B7923AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649138, "uuid": "47205d21-37ae-43a5-9503-ce2984f12f4d", "value": "3072:Ke7D98XHHJfPYDMalIlkTF+00N7tHvEdNIOAO2m/NzKd57eujmKk/XLO9qJIa0FZ:tlO15JOf8dNkD79q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781649138, "uuid": "5db0189b-c788-4eaa-8310-15a8064c0fb8", "value": 3959668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781649138, "uuid": "676af8e6-2984-4554-b58f-25bf02cbf7e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649138, "uuid": "6ccd7b87-fc2e-4b4c-9cda-22ff68eb1434", "value": "ENQ. # 11791-7DKRC-SA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d8c6f9-698d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781619228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781619228, "uuid": "8250630a-51b1-488a-b9dd-e8eae047cedf", "comment": "Malware payload (Mirai)", "value": "4a530d38f22c6269dad2a03fb65766bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781619228, "uuid": "d3ad2d84-9a02-4883-b4c7-d727bd4fd6d9", "comment": "Malware payload (Mirai)", "value": "b02502273fb7a865ec52b3c87f565ad4164f55206947606d48c29047957479ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781619228, "uuid": "952bef7d-7677-4af1-a92e-d7f919a8c9d3", "comment": "Malware payload (Mirai)", "value": "32a10a602081eba29014f8cffe1f35bacaeae77c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781619228, "uuid": "8e80405d-f91d-48a8-b1ee-06c1561a35d7", "comment": "Malware payload (Mirai)", "value": "b46deb3f6e3f8f35f9e8db492353c6441a0691cec09914367df128e47a62605fdf8b04f2145ec08cbadea9cf559dcff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781619228, "uuid": "9db13903-1c03-47f9-b90c-87138337ca0b", "value": "T18B640293D721BD9BD80386B0656F13987378C28AC34B928173489D6D397E34617AA2CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781619228, "uuid": "fc4145ec-788c-4aff-a461-b5544923aefd", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtobQ33Q:2IIKXhZtL7jOTyIG87XGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781619228, "uuid": "ad717c4b-d1ca-4e44-9758-b004bc08e72b", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781619228, "uuid": "b6bbdb97-4a4a-49e1-ab05-6a62cbb9705e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781619228, "uuid": "8441e8ed-289c-40c3-9697-db4203a1e264", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8055d49f-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623054, "uuid": "d25c8ae0-5102-4f42-9108-493a937b1d2f", "comment": "Malware payload (Mirai)", "value": "6719d4ed184c3c43a67ad4b48f8a058a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623054, "uuid": "ae2575d7-1f13-4d54-963d-b4f350ceee4b", "comment": "Malware payload (Mirai)", "value": "b1f182f4744a23c4c404dcaa3898cbace8815bdec4172ec744996e67f1af6630", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623054, "uuid": "edbd8c57-768a-4e99-95ea-30ecd498b0a1", "comment": "Malware payload (Mirai)", "value": "4f172cc0212cb305677be044656598d65d76b0e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623054, "uuid": "05b33f6a-585a-475f-ada9-95b0e76562e0", "comment": "Malware payload (Mirai)", "value": "5e243ce0cac990f0c1e3052fc0c6230a6af67c20de4c8bb2327307e043abdc0ee21784320aef7c35e43ea0e16b29b8a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623054, "uuid": "c303a03a-0d77-4de3-91b3-d6404bdca66a", "value": "T13DE32AC7F800DEBAF80AE73B48530805B530B7E115925B372257797BEC3A1991977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623054, "uuid": "ad9e28fc-78fd-4318-aca6-013c2de463ac", "value": "3072:g/KjTCdKXh2ecL8MOJD2WB1/VgjbiRLlxvyGZRIKO:g/kUecL8dJ3B15LzyG/IKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623054, "uuid": "58eb959e-09b5-40fa-ba5f-c47d19619499", "value": 152992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623054, "uuid": "acfc6556-bab8-4443-b8e5-a02a345ab3d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623054, "uuid": "41f45bd9-922f-41d0-afb1-6d4ceae94940", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6760473-692e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781578504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578504, "uuid": "8e960224-334e-4240-8d16-0e904771e766", "comment": "Malware payload (RemcosRAT)", "value": "5608d18acef08555e415bd66f6447696", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578504, "uuid": "89d3c59a-b7df-4ef6-9f3c-6e9509fe96da", "comment": "Malware payload (RemcosRAT)", "value": "b32425dba354fb2ab5c58d17d2cdde3b3a85105f009dfc48ec02beb2bc4056a4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578504, "uuid": "e6242833-3a7a-40f3-8431-6f9d15202fa1", "comment": "Malware payload (RemcosRAT)", "value": "d815da1988a9bef36034af798e3a0ac269fb73c8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578504, "uuid": "5739c9be-236a-473a-a9e8-174f3881309b", "comment": "Malware payload (RemcosRAT)", "value": "04ba77e4e724b6c398507117dd839aff9adffe708063ab43abef7e1bed0da529b88a0491d376f162284a3815cfcb285f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578504, "uuid": "4b39e8d1-0481-4e4d-a5d8-78758d1770a3", "value": "T11B331A74EA704B95DE4317FDEC8C69A0D928CA5B063300D4FED42358A40D6787FBDA69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578504, "uuid": "76901008-7d09-410f-a2d6-a5cc060dafd7", "value": "768:HV7sJahE8dBM9267aalWq6ReJo9Ja0BQnAv1tOBn1uTN7xaQBNmVnu:HV7ZMEksq6VJ9KZneN7cQBNm5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781578504, "uuid": "0cea5aa4-7b8d-4c34-8b0b-2024b8f96bf2", "value": 52152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781578504, "uuid": "5322d29c-a0c4-4c00-83eb-c3400dcf7e15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578504, "uuid": "21fad44f-78f6-492e-ac03-e6d2975c1f35", "value": "Virescent.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb564885-6966-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781602644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602644, "uuid": "7229bb26-4b5b-437f-858b-07bcdc7ec32a", "comment": "Malware payload (AgentTesla)", "value": "4459bfb14f15560055dd7629a2b76be6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602644, "uuid": "7b6fcca8-fab4-41da-aa66-8576f34bbee9", "comment": "Malware payload (AgentTesla)", "value": "b37c715ffd26966a559b6b20a93f7beafc3b70e0bc5e8ad04f64f6bad4d1d367", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602644, "uuid": "1f4943f6-c95c-4727-887c-951740a2cb3e", "comment": "Malware payload (AgentTesla)", "value": "6b7de815810c9f6c1f5e0461e5fb4db690046f06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781602644, "uuid": "7b396715-29a7-405d-a081-f7e8fee45248", "comment": "Malware payload (AgentTesla)", "value": "9e79dc4e2a172d1926620b3c945823b1e5f9059cb2cda1ca7965bcfd5061e026d5d85556a0f9db80c7b2da93155a60df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602644, "uuid": "067528ae-2358-4e58-bd85-375e5b5200be", "value": "T165F275C937C2F1A04227E53B393BB4EBF22F4C86A6489494F3DAB159F858714C971768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602644, "uuid": "96832498-1dd4-4406-be46-a7bed2008d9d", "value": "768:DQwms2oSrsHYBTYvIqDMIyKU3L6iFTWfGv+ihN:TmsrSrsHYBTYvRIIyKU35eWhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781602644, "uuid": "436c357d-b5bc-4faf-9928-49e8ab37f70d", "value": 35732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781602644, "uuid": "197bf9ec-614c-43ae-bf64-1df94e63820f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781602644, "uuid": "84585a72-efb8-4318-b45f-241e3918324e", "value": "KJHFHJHJ34.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0981cde8-69cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781645618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645618, "uuid": "75191972-3a4a-44f9-bbf5-d5de72f07fb4", "comment": "Malware payload", "value": "95df7aefbe40b7ff15dcd388d60448f4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645618, "uuid": "840c255e-eaa3-4ec0-92d7-bf1007efbeab", "comment": "Malware payload", "value": "b3bc60218c120f424df75933e14fdcb3f22fe2a5e5eb8cb274e7bb8e77799310", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645618, "uuid": "432ca4a0-463d-4588-a226-f1297397f7b3", "comment": "Malware payload", "value": "02ff517ccd0d70b275cfea1c4c1fe616e6bdd4d1", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781645618, "uuid": "694c942b-02c7-44ce-b9c7-3cbb5a5a4734", "comment": "Malware payload", "value": "6b17827554d779e2860e517ce7f8b9fc1ba7aa9b850a3484d3cf79d9839a04d798c87b757663dcf48d68b7c2b907956b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645618, "uuid": "a4998cdf-f8d3-4714-80b4-d1d4a636536d", "value": "T1C6553301694E2334DF98A2BF785CA8D189683DA02B7A84D4B34AF78DF47BC641B73534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645618, "uuid": "cb9e2e74-a23c-46c7-8474-e2101a778879", "value": "24576:Olu69Z8Koh5Is3Bgbdz0HxwyGYuMa6tvD71eIS6qFUXBWsBjTIJ9b3vrcWmsHDno:OlNT2isgdz0H7vDy3mhdIjbfrpJHDnDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781645618, "uuid": "4cfeb741-02a4-4c0c-9075-f70ef7e8fc40", "value": 1351680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781645618, "uuid": "27a75a0f-d2cc-4e03-9972-1cfd93c32d31", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781645618, "uuid": "334c77ed-7844-4854-b48f-add2ceffbbaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a3ece4-69da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781652287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781652287, "uuid": "b912e408-8b0c-4200-8f51-e669fab14e96", "comment": "Malware payload", "value": "a8743ebb496ed83cbf91544aa739d5de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781652287, "uuid": "8e120a95-a208-4973-a6f2-e2f0ebea49b0", "comment": "Malware payload", "value": "b4e7a3375a80a0da7b08f6caf8d83d795e01dd0693d9e76dd8f8ba6e8a03f1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781652287, "uuid": "6f8415f9-4cf1-44d2-adda-74791c89705e", "comment": "Malware payload", "value": "66bbca94092dbf7192945e5c82ec3d8d9440622d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781652287, "uuid": "56c02bb4-922e-4611-8aee-4445bd018482", "comment": "Malware payload", "value": "9806ed887fce0c9273e1307752dea6f3508727b42bf1e28806f51f79bd4f87c370dd6c15d71d27c9ffacb635a4fa54b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781652287, "uuid": "0261063c-63b5-4a66-b6a6-cbab381c11b5", "value": "T1B845D02937D88688F47ADB364A720B4407F2F987D921D70FBE4A31DC48ADB569640B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781652287, "uuid": "0e79e5a5-05ef-49a7-b0d4-73359182f16c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781652287, "uuid": "f076c269-c908-41e6-8110-22e060492673", "value": "24576:Ailb0HsBsxpbrqKR1N9EnOTmmYM2KjOJHU:AessBsTbFN9EnGmpBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781652287, "uuid": "b79a6414-c1ee-4a21-8115-ee55973c5367", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781652287, "uuid": "fed31679-a4e9-4a2d-8281-41b4aadee8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781652287, "uuid": "f0d8f187-8195-42c2-98b0-7312e404a210", "value": "New Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c723493f-69a3-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1781628756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781628756, "uuid": "3e9025ea-3d89-4bcd-a89e-9659b0836706", "comment": "Malware payload (DarkTortilla)", "value": "345a1ab350f2c7ddabf686e27e784941", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781628756, "uuid": "913fa281-223b-4d76-8c3b-dd7647cbb912", "comment": "Malware payload (DarkTortilla)", "value": "b4f2276d77aab7af850e2994faf1f44524a4356ed3ffea0e1ddd4e56dfb274c7", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781628756, "uuid": "ac62e89b-2c03-41c2-a8d9-a3e3438901de", "comment": "Malware payload (DarkTortilla)", "value": "3f77b99063dff07b1310a98df2c6ffb1ffd0e171", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781628756, "uuid": "41bf9a88-b3b1-4209-a6b9-c38b3432e5a3", "comment": "Malware payload (DarkTortilla)", "value": "4fea4b487961d1d03f05cfb0865cbf14363c955c5180b593144b33d14066e36c93b2ceb6d41744c58690b8d5570e1813", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781628756, "uuid": "25f2632f-7bbc-466e-b395-55fec2bd7424", "value": "T19905CF283DC6864DC5789F75C6732B8837F1D94ADB82D307BEDA30A8892F797C504A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781628756, "uuid": "4330278e-176d-4a49-8452-cd16a153b8dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781628756, "uuid": "026b2c8a-880c-49ac-b1aa-82794f7f65bc", "value": "12288:WhqNe1lGlzKi3E13hsBEhijE8wpVlSW/CKR15XpN9vw9FD:WhqNslGlb0HsBsxpbrqKR1N98p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781628756, "uuid": "37c7f5e3-be67-4bb6-be25-f4169d68eb71", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781628756, "uuid": "2f8b68e7-caf7-4730-82ce-1cb69bc41ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781628756, "uuid": "64456751-c347-458b-86b2-7311f166fcfd", "value": "saldo pendiente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22581c63-6984-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781615165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615165, "uuid": "2e0de51c-38db-4b3d-a767-69a76e4f8279", "comment": "Malware payload (ConnectWise)", "value": "435a9ca02b7f3bf72aa917a9803a0f63", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615165, "uuid": "bdd295dc-33ab-47d5-ad9d-580e9ce338a7", "comment": "Malware payload (ConnectWise)", "value": "b7913355c3a29e9bcb4bc950dd8395b8429ec65a84e50f4ce173a313394b84d8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615165, "uuid": "e3ae140d-4ce7-4295-bb49-41ee6c918ec0", "comment": "Malware payload (ConnectWise)", "value": "dc9a86b989cd11cc82d077e3b5d28ebd8e168dd2", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781615165, "uuid": "2a36ad24-91fd-48c7-ba25-57a05f3eb0f5", "comment": "Malware payload (ConnectWise)", "value": "ff45f764674b88e55e750557ad96f5a2a7d897d42c7c81e015afdafd7fc2ebaabff6118556a967824de11abee9e256c2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615165, "uuid": "26326b80-6000-4ed6-843b-781c0ef38523", "value": "T143836C43B5D18876E9720E3118B1D9B4593FBE110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615165, "uuid": "ae5ff114-d6cc-4201-9e28-20d0c0c1ecd6", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615165, "uuid": "6f2a5eb7-125f-4195-802a-efe4d1fd7426", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYj70Jo:genkyfPAwiMq0RqRfbaWZJYYjwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781615165, "uuid": "d1198016-bd6a-4e7c-8c75-a7455e664f83", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781615165, "uuid": "8abbce20-adec-4567-b8fc-14a564e9a427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781615165, "uuid": "7404ba88-a399-4796-b6c4-35b4780bae65", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10351ad-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607754, "uuid": "0df8ff07-1e37-4934-a065-ad474885d18c", "comment": "Malware payload (SilentNet)", "value": "7fd5ec4461ca6e862885ac5f32881887", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607754, "uuid": "0536aad4-0d79-4bbf-bb19-9dfef7cda12a", "comment": "Malware payload (SilentNet)", "value": "b8583851614d89406a9fb8abea7cc4b44772ebc38f73afcab719b2a46f2ab998", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607754, "uuid": "d724138b-e685-431e-9d94-d7e5920d6bc7", "comment": "Malware payload (SilentNet)", "value": "fd7bff8496eb728dadfd67b6a94f5603bf377b33", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607754, "uuid": "36618698-06bd-46a1-b38b-b864126700a7", "comment": "Malware payload (SilentNet)", "value": "9abf931b62520b767e467f947cda621943ec2fa83503339ae72c607c1a8e95d77083b9c4ad5ddb948f063154da2e46f0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607754, "uuid": "ecb69ac2-35fd-4924-b3c4-44e742112a65", "value": "T1EE462352FA0D647DD007933358554EA6B82886C9F14FE6BB32F815EA1C879C72F6870E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607754, "uuid": "78d1a8dd-283c-4249-bf93-68cc185e5dcd", "value": "98304:IDNJKx5wXm3KMMyLbPn9NuNAwbrupLggtRBdC/2moRFMhG2UkyMFez:LgW6a/9NmAwbruPte2fSh8nKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607754, "uuid": "92d3d110-56ed-4332-a7ba-fe91d1413c65", "value": 5543572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607754, "uuid": "d400f62b-f811-4bbc-a934-e7aec1791619", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607754, "uuid": "53862ca2-655d-4898-872e-d98de943f37c", "value": "NoxxClient-1.21.11 (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94709a0f-6975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781608914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608914, "uuid": "e93b414e-a86d-479b-a399-d335b0a44c9b", "comment": "Malware payload", "value": "5e7a6e6e1eb2568e299e6c35f35e5182", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608914, "uuid": "5a9bd4d0-d141-47a9-9a74-9fbdd4eb0426", "comment": "Malware payload", "value": "ba54fd710211768b0b67ce62b9929e0c71e4842a231c79b9a0197e95809ebd8a", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608914, "uuid": "ace41080-3541-4d02-bfe8-57d26b0b08b3", "comment": "Malware payload", "value": "c2a410daab4669c95a703cfaf3ff20b8f039d671", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608914, "uuid": "232d4a9a-ffcd-4259-b281-0900ad8ffbea", "comment": "Malware payload", "value": "de35c82e45cb62f8190dd0e50d045aae2f8f2cfaa4a7c5c9c56ac99d1acde5a79917ce0f11a3839823f5f7dae66814da", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608914, "uuid": "fbc38446-d698-48d6-923a-c3487c43ae26", "value": "T1AD62A5967205C3C6B68A9397B2DBE8CD3B08C039026B45A0FCDECF0D4359D5592A4B9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608914, "uuid": "3c79032d-5097-471e-afc4-7849ed9298ed", "value": "384:VJS7XuFcT1n7Lua7MuzaR5LaqDesmpI7IAuAf45YlpEqGbAKqfgqGikAMPsTZ8W4:VJS7XuFcT1n7LuaIu+LaqKsmpCbmYlp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608914, "uuid": "0d1fc14f-2e11-41b6-8423-891dbead90ca", "value": 14725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608914, "uuid": "818eb94b-1bd3-4bdc-91de-b26d23cdd831", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608914, "uuid": "0cc75598-49e6-44df-b249-7d36700dd9aa", "value": "ba54fd710211768b0b67ce62b9929e0c71e4842a231c79b9a0197e95809ebd8a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fedc4a6-697c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781611752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611752, "uuid": "7e11f16d-f8e5-4711-b730-71d5c8b36e72", "comment": "Malware payload (RemcosRAT)", "value": "fd1ea8ebf245436c953a6e10fefb2bb0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611752, "uuid": "af9ad415-ad87-45c2-a7da-fe263f724667", "comment": "Malware payload (RemcosRAT)", "value": "bce8fd7fc45afac684eec2f09ec530d4f03e808f7aad5ace330ecff0ae3ad49f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611752, "uuid": "5e994791-2b1a-42df-9585-c89a2215f91c", "comment": "Malware payload (RemcosRAT)", "value": "9236ae7d69cb433a62b981f4bfa9049282f4c583", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611752, "uuid": "6dc71eef-b7ce-4f76-ac68-85daa6fd046c", "comment": "Malware payload (RemcosRAT)", "value": "c7a1b0a20dca7eba6ba233fe82e2ed0d28be9bcdb24d2ad3c9d0a5159f2886d2bbf1959c90a20a20ee6bd53933ff2b28", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611752, "uuid": "68eafd8c-8ff6-45e5-a533-643bbc8e7672", "value": "T1EED40161F2949A0BCF1A0F7A87C7C6AA5A11FDA05E5A860F7144736F2EF36912D03D0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611752, "uuid": "ab2233a9-16d4-4d6e-86bc-86d28c9b1f45", "value": "6144:XLFZsNjvayi/zZ+RwPONXoRjZ7SezmfDlavx+W/WGW3i9BxfQvUNNtnJQ/jrLE+a:XLH4jiIi9PQvUJ0iqLHMzc/paaFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611752, "uuid": "d748b22c-49db-4853-b778-875fb70c4e6a", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611752, "uuid": "f7e0017e-6c78-4ec8-b0bd-8f8d5f6d9a08", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611752, "uuid": "45f92165-d4ef-499b-b53d-6825ec8723c5", "value": "doc12594020251129074.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f7a517-69c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781643438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781643438, "uuid": "f3ba4883-8dcd-4579-996a-d843e79af093", "comment": "Malware payload (Mirai)", "value": "611e9c408c7f2d5889f5a608c4f8be46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781643438, "uuid": "5bcd46f3-9a3c-449f-bb1e-3dc5785e2afe", "comment": "Malware payload (Mirai)", "value": "bd84382bbfb1ecba14472931fd7e3ecc3d1cf04d01d1b9378990ec6e21d91221", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781643438, "uuid": "3211d869-de0a-4384-8d33-64f0c0fd2e21", "comment": "Malware payload (Mirai)", "value": "f9abf184f8153afae9eb343845af1ff4dcd3be07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781643438, "uuid": "3fe73bf2-2b4d-4db2-8a82-58da217155e5", "comment": "Malware payload (Mirai)", "value": "71eeecdaf0bddfebb650f0da9366b0740c57d925f166d4597dd32d88250cb58911967db62ade407a716c4078314e8f29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781643438, "uuid": "9b368933-d0da-4189-a17d-37f8028ec713", "value": "T17D737CCAFA83E0F2FD8315B1657BAB329372D0395055EE82D32E5836DC52811971B3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781643438, "uuid": "9ef4d2f3-4d0e-4390-b167-4ab09f7cc908", "value": "1536:65bvByyh/FYGtndlJHw52GSOOYWZJ0xO:65ByyjPnvBww/3pJ0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781643438, "uuid": "09a627e0-ae52-4f3e-9bb7-ebd1e22b2ec4", "value": 80264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781643438, "uuid": "a523bb54-6833-4064-a071-f5076164fda1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781643438, "uuid": "9700402c-19ea-483c-8136-34c3cde1f55f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399ad11f-697c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781611768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611768, "uuid": "30eed538-d86a-4989-a65e-2a81aad458ed", "comment": "Malware payload (RemcosRAT)", "value": "5aea7078a593db98b16014d6d505f02a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611768, "uuid": "38bba1d4-548f-48f9-89ce-776739c28a4e", "comment": "Malware payload (RemcosRAT)", "value": "bddd8364e316a038ca59afe41d51ee9e0a7a787892d0e8b0b369d37583d6ab86", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611768, "uuid": "4eb63d38-e31e-49bc-a283-e9b3a8e99066", "comment": "Malware payload (RemcosRAT)", "value": "4cec7025cf8b232b09b46616f4e2faf646357b10", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611768, "uuid": "27d40291-424e-41e9-b10b-f16bc458130c", "comment": "Malware payload (RemcosRAT)", "value": "5cf8d8a7e48eb190aa7d20019fe49b1b6aa367d550db6a85c0702c83bd6de30653c890d7980edf7b064fd854819a61f8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611768, "uuid": "f0f0e44b-8519-4944-8293-dd469a28f395", "value": "T100A4F165F595990BDF4A4F399BD381F58A11BDA19E2E891FB101730E2EF36806D03E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611768, "uuid": "1e5777ae-ffd9-4500-a0b5-829b39a0bc09", "value": "6144:ooJkZ+RwPONXoRjZ7SezmfDlavx+W/WGW3i9BxfQvUNNtnJQIrLE+gTzTpZBjdto:Pxi9PQvUJuIbVim1hsdQenwQF65nm0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611768, "uuid": "cfdd34da-c98d-4106-af48-fcd4d90f64c1", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611768, "uuid": "723e474e-ec04-4f33-8d56-99bf66d9d4a4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611768, "uuid": "d81593ab-2012-4237-b1a3-cb34bff9c203", "value": "OC - Orden de Compra..908689900233.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba56fd38-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621863, "uuid": "0e26f014-c249-4f17-9307-2da11e2649ad", "comment": "Malware payload (Mirai)", "value": "b12d552de91d9cd2c219aa21a10ac3bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621863, "uuid": "f404e83a-90c5-4c67-998d-10c9a75df76e", "comment": "Malware payload (Mirai)", "value": "bf6f2752ac62590c83e33c3ffecc2218ab68e3d80767cacf490b6460388b0368", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621863, "uuid": "e1106a40-11da-4f57-bd89-8863c257e2e8", "comment": "Malware payload (Mirai)", "value": "454dcca948a4ce6c8cab9b3ffc5feafb897151ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621863, "uuid": "525d3040-f5e6-4db8-ae11-d3c5aef02138", "comment": "Malware payload (Mirai)", "value": "b2f10b05573b5d46e3cf067444c5643288945c55568a7c08a66f06946ea1c11251079c0344b58b18772a1250efa5648d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621863, "uuid": "3b7203c0-8d1d-4b3d-bd91-7e67e2774de5", "value": "T1BA735BC6EA83E0F2FC4315B1617BBB229772D0395065EA82D72F6835DC52810D72B3AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621863, "uuid": "bb131964-9004-4d69-973c-6cdf9bf0db7c", "value": "768:nF4DjnNF7Nq9hyzYo0MFHhQ8J8v/bKse6DS7yiW68PLi7gZV30SGx1rkodHmWZJg:Cyfy/0MFHh7mu7yNNgaaSFvWZJMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621863, "uuid": "406ddd47-9cc9-4259-9a8b-4d8d64bd4211", "value": 80264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621863, "uuid": "16fc64ce-5c16-49ab-bc73-6eae85dfad4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621863, "uuid": "f54ec37d-ce87-497e-a8d4-18f1f6627e8c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8334ac47-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623059, "uuid": "e4a3dc91-11b1-4646-a9b0-815201117b58", "comment": "Malware payload (Mirai)", "value": "3462cce81100e6a3d7b48187e12cc890", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623059, "uuid": "81ce7adc-620c-4dbe-9047-9625d311a24c", "comment": "Malware payload (Mirai)", "value": "c09e7088ad96e592abeb536fb94b88592c0215e6028d14668fa28a1f06036e13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623059, "uuid": "58c85136-bcc5-41c9-a5b4-45968e97f7c4", "comment": "Malware payload (Mirai)", "value": "853e62b7d147eed7dc0a4d4a2215773eff25f0b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623059, "uuid": "16929868-c8d5-4510-8634-1bb8ae908810", "comment": "Malware payload (Mirai)", "value": "cfaf3e4bc16b08eb4eb93441cf7f93543423007d165999009902ee0ea5ca4338fb7818219fb6b457eb53326c18eca57d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623059, "uuid": "99c04e18-a248-4fc5-a03d-bdc23ebc63c5", "value": "T1B4C36B73D8656F68D655C170B0B08F782F53A5A082875FBE1AB3C2B54483C8DF606BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623059, "uuid": "fdf32001-9980-4120-a42d-84bb043c05d1", "value": "1536:SvM/rW0Ny5VeSlu8eikCFSKpFRyZz61k5viW6FTmmet+xi0Z:SUzW0GeGTeRkVpS61SiWQTm2xf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623059, "uuid": "91355b15-7bdc-43a8-b157-3b05332a1b3a", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623059, "uuid": "d50e1f0c-0639-4be1-8c34-bec2e892fcfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623059, "uuid": "f19e1924-261b-48ea-9bf6-c6a751b1fd1b", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f37859-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781607523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607523, "uuid": "e3b7fd0c-4757-49ca-80bd-75ab99891b11", "comment": "Malware payload (Kimsuky)", "value": "ab20d2d8cf523e879bca392a12a1c800", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607523, "uuid": "31438b2f-d5f9-4ed0-99b7-435e3488d8a1", "comment": "Malware payload (Kimsuky)", "value": "c0be3e48acca1d6fa01a9a65309459496eeb118320b32ebff8924cce797ced44", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607523, "uuid": "487af4c5-6cd4-484e-94df-974299389836", "comment": "Malware payload (Kimsuky)", "value": "cc733e0ab3d304b10403c75c680d98290bc7677a", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607523, "uuid": "3d3b6aef-db5a-4c57-9825-cebb78dc4432", "comment": "Malware payload (Kimsuky)", "value": "41255d569d0651563480f10c18e3aed1c752853e971f089e4302cca02ab99c87805d04587d928583076f78a513543182", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607523, "uuid": "eaff4a5d-fe39-4c0c-b809-ab06b1cb7acd", "value": "T1D4C25254BA4B87C3D9B5C5971C18D9B3F3DFA60C0713A9FE24468C69AC41239E15FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607523, "uuid": "33178e5c-bb92-4da7-a754-4898c2712ad2", "value": "96:4nuHear7jCL1bQaz4ScTtgxUMRtNthtOqBxVl1wSo7kwtplkUOBAq0T+5v94TZS2:4upr7jCSngrRtNthtOOxVgWYkUOXSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607523, "uuid": "df14b773-6ab6-4859-b4ea-f0cef4c1d5a1", "value": 27030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607523, "uuid": "6d26b9e0-7a1b-4f88-acf4-7fda1c3b85fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607523, "uuid": "ac3776e0-1493-4226-a5f7-3224a604be0a", "value": "uni.site.je.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f590337f-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781608648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608648, "uuid": "64e3a36c-26b0-457d-8ffe-8ea09fbd1d75", "comment": "Malware payload (Gafgyt)", "value": "047fde711551e5b8867a9f80b51067ad", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608648, "uuid": "fffdeddc-8b5b-45d4-aacd-4bcec37f2577", "comment": "Malware payload (Gafgyt)", "value": "c1350b036885442df0173a4c9dbbad9603ad4d8a73e40cbbed805373084a6f26", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608648, "uuid": "af20b6a9-414a-4920-b4a1-6bc58ebc2280", "comment": "Malware payload (Gafgyt)", "value": "993ca2bd3b4bd233b333b63be233362e1fd41e40", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608648, "uuid": "44bcc859-c3cf-4417-b064-af83c59b5a34", "comment": "Malware payload (Gafgyt)", "value": "e5845dda16c291ce2f05111eacae03c9dc8a09a6daea00998b352e8a0f3beef181c1c5244a9a8ebe2603f34e68befdc5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608648, "uuid": "22b297d5-1fc4-44b8-b174-af120c31f52f", "value": "T15F71B5C652E34971BDE2592B7278554CB2DB7A8750CE5FA0D8CC3CE6014DE04F98AB93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608648, "uuid": "d4eeadb6-7df5-44fb-9a8d-68d83210bca4", "value": "96:HjF5jpdj9p42jtgOjtljFBj/RjtdjxPdj5f5Tjpj9jtRj1hjtZj4O4bCG:DFJpN9xtgut1Fx/htNlN5f5P9tth1Rt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608648, "uuid": "0e22861c-714f-44de-9cdc-6fae5929dd17", "value": 3561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608648, "uuid": "a375fc5d-e3ea-4847-b30c-ec15715bad81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608648, "uuid": "64383eb9-b49d-4e07-ae6d-26e6482f2d75", "value": "painbins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf858ac-697a-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1781611100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611100, "uuid": "adbc5a48-8020-43a4-ae3f-1d66e1a6814d", "comment": "Malware payload (ACRStealer)", "value": "b4352b63afaf0d6888c9f5f4b250668e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611100, "uuid": "d3bc4086-dfbf-4d99-a8ad-49e51aa153e3", "comment": "Malware payload (ACRStealer)", "value": "c1e8ea0ebbe41a5714caca4fc85046de84dd82553379c16b7f83b0c7fc8ce20a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611100, "uuid": "bba452a1-a02a-41e4-879f-6ccec799841a", "comment": "Malware payload (ACRStealer)", "value": "1656334adf66a7d04de72119fade56652898c366", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611100, "uuid": "3dd5ab42-d533-4e7a-9db5-e0863805476c", "comment": "Malware payload (ACRStealer)", "value": "c27a8126bddf292bf54a0edd256178562070312c0a268e55b413d791078dd55acd7cd0bd46ad9320b7394667392c3678", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611100, "uuid": "3eb118ff-a83b-4d97-97ba-46089d962bc0", "value": "T173651215828C049ED64BCDBA2469117A8F7DDC52CBE341CB74CCDD903E871E2AD3BA99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611100, "uuid": "33d3aae0-ce16-4f9f-beaa-20f453878911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611100, "uuid": "bc17b978-0657-4d3f-958a-2d41927b7d99", "value": "6144:IeLKqFnq0nq0nyw9r9c5X46ZwuJD2gbWusPDjMs/FX+8i8z/xE:I2KKnq0nq1wyKgiPDYs/FXguE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611100, "uuid": "aa5f484d-af70-4b21-85ac-cdf364cbab90", "value": 1513728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611100, "uuid": "139533f8-2e12-42d4-aea0-0e3e20d25d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611100, "uuid": "43d2ba1c-17e4-4335-93eb-e2ed1e76677b", "value": "DesktopWorkspaceSync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32aa9002-697c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1781611757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611757, "uuid": "58d3da4c-7f36-4d8f-964b-468e03b78cdd", "comment": "Malware payload (PhantomStealer)", "value": "1c5b5d8a4297a3f114f7e8148566cb85", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611757, "uuid": "fb114fb1-f4c6-4db2-b0e0-58c23cd2026a", "comment": "Malware payload (PhantomStealer)", "value": "c2eb07d2305a113344f81a405e4e92a446400032e29c1444c63a571c1b7edb65", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611757, "uuid": "fcec965b-fe28-44bb-bdaa-8d9e3416aad0", "comment": "Malware payload (PhantomStealer)", "value": "d03fcb0141bfe3fa3291e54b5cf3d02b522f5054", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611757, "uuid": "b521fa81-3ec1-44d0-a367-dc3620bddac5", "comment": "Malware payload (PhantomStealer)", "value": "d9bf909d877a06070586d70daec5e10af634cf01fc1e90a236aeafd6b63cc1c6f342098f19953cd16ed1000f446499dd", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611757, "uuid": "00705337-4b3f-4289-94b3-5232effd68fc", "value": "T116251206F854EE0FDF534B758D87D6DE9525BCB09E5B86473280730E3E72AA15E0328A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611757, "uuid": "3c27559a-d972-45a8-9e9f-915761c52da5", "value": "12288:nLH4ji4Si9PQvUJ8bAW4cX6cASczEjNvBBWNR1HbzvsDoS8N01+6BEswSZCfy9sH:nLHiio94vUOnKLrR17zPS8u+6tmya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611757, "uuid": "c0e82123-6db0-4adf-8926-c0b9797c45ce", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611757, "uuid": "386a2bfc-6f25-4abd-9406-4b7373145b0e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611757, "uuid": "4bd8b139-6418-4c64-b75b-ff3da48152aa", "value": "RFQ_TFS-1507.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913661ed-6988-11f1-a769-42010a9c0008", "comment": "Malware payload (NimBrowserStealer)", "timestamp": 1781617069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617069, "uuid": "a268004f-0b46-464d-804f-3a1000d7eb87", "comment": "Malware payload (NimBrowserStealer)", "value": "fc5a6cafed04f3f052d8b94d20eeb650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NimBrowserStealer", "colour": "#E0B2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617069, "uuid": "f322466f-84fe-4f65-870f-ff4b5b545bc4", "comment": "Malware payload (NimBrowserStealer)", "value": "c32864b6ddfede2177fc0c4ba11ca21ae80cc0c3e1b3d218f4920ea2ddc3e46a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NimBrowserStealer", "colour": "#E0B2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617069, "uuid": "3aa8bb33-acda-4830-a8c9-fc244af6ee54", "comment": "Malware payload (NimBrowserStealer)", "value": "ac82eaea1253f735c782ef58d464ddd8e86f3ab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NimBrowserStealer", "colour": "#E0B2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617069, "uuid": "a171533d-3789-4414-b3cb-7fe22d773cc6", "comment": "Malware payload (NimBrowserStealer)", "value": "6dc69e9f484d3d31ab4c38a5d91171d999a39da06c2f30444b7e753115ae630f82bc209c4db1bf8a51a134bb242f6f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NimBrowserStealer", "colour": "#E0B2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617069, "uuid": "04a2741b-48ca-4751-8517-314952ff65a3", "value": "T15C85C08277C46DDEED5552B5C46E5766B33CFBA14B978303092C72308D03AC29F9A78A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617069, "uuid": "8a825083-220d-4a87-9704-7616204ad071", "value": "e8b2e0ecffeb164840b2a7480d4d64d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617069, "uuid": "77ba17c4-d15d-4dff-ba93-041bfe9e7fce", "value": "49152:0vyZ8vO4IgNRoX+qDbZCTQO81poHpOCjB4weW:7Z8vlJNuXXMTOCjB4weW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781617069, "uuid": "d1da104b-8688-4d4a-9b52-6cc817a1a36f", "value": 1850368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781617069, "uuid": "0cda34ec-b56f-46d4-b378-b77391b4da85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617069, "uuid": "2448752f-c047-4115-abee-d961e2154f32", "value": "c32864b6ddfede2177fc0c4ba11ca21ae80cc0c3e1b3d218f4920ea2ddc3e46a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b4939a-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621858, "uuid": "069f01f7-536b-425d-b0ae-25de71491fd5", "comment": "Malware payload (Mirai)", "value": "a072120020ecc7a8b65b579e50a6f853", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621858, "uuid": "1122e316-bb62-4069-add2-8e3b32ea9d98", "comment": "Malware payload (Mirai)", "value": "c37a9d5569e73fb09f5f231e3520190c4bd491d903499582c30ec8a2e3b12839", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621858, "uuid": "e48d6245-f716-44d6-be7f-e31fe064a7c1", "comment": "Malware payload (Mirai)", "value": "615df4013a7725ebe9b6446363911b295a35ad4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621858, "uuid": "90b21b92-54a8-4751-b411-fa570e5c28ad", "comment": "Malware payload (Mirai)", "value": "720487e036762ea5ad8e47f127ffb9e8b6917c9479fb6b82d76cd080c57919c1d3c2991108241b021ba6158f0b07d7f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621858, "uuid": "3c1464f3-1f89-47c5-a25c-d77b2e2c8149", "value": "T1F0B3E845F8508B53C6C652BBFF4E438D7B2A175CD3EE320399296F64379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621858, "uuid": "d299b922-e6cb-43e1-96bb-c49b63aa0380", "value": "1536:Xx1b5pQMtPYB2CLWpAnI44VH33TVPnLY6O6STr2tEQxlt/wywSNbAtyfYJYsU2NI:BZTQiwB2cWpY4x3JPLu32SJXrN3dJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621858, "uuid": "b25e6bce-b00d-4873-b39f-2922e4a4657e", "value": 113856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621858, "uuid": "9e156d39-5a3c-434f-9e0b-1653904b4088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621858, "uuid": "edabbaea-cbdf-459b-938e-a2550e0f5586", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28659a87-69c2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781641804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641804, "uuid": "6c0f9880-bb6a-4089-8364-53cc8aa295bd", "comment": "Malware payload (RemusStealer)", "value": "5b4474c82d9b379676013d92a59db2e6", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641804, "uuid": "bed5838a-f282-40e5-9df5-a0f7e8789f5c", "comment": "Malware payload (RemusStealer)", "value": "c4ddc279b913182cdeea144a065415f26a8988648b8415f25369204ecb54cf97", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641804, "uuid": "4d418b75-b063-43aa-a636-7d8fbf7c436e", "comment": "Malware payload (RemusStealer)", "value": "4223d5ea0766870914492e4fd55518838e5cb0bb", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781641804, "uuid": "44e292e8-4451-4fb3-ba70-618faf55dd05", "comment": "Malware payload (RemusStealer)", "value": "e78a7e1c8ffa4847d420ac2440676379483c36876412f50d24f050a80e85fc255871025879ce73821503b0d7e16a97b2", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641804, "uuid": "d10e14ae-75a2-4370-b3e0-f2e5021a768e", "value": "T15D848D1AEB6500FDE167D138C9670902FB76BC4A47A096CF23E449962F236E19E3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641804, "uuid": "096590bc-8c45-4d5f-b29b-d379a1bb7ff3", "value": "c882a20772e0149fdb29801550fe1c7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641804, "uuid": "af7bda10-6c06-4fd2-8062-724c816fb015", "value": "6144:tC79lX53Ksbas3EBNtjf3EQ3N18bRBZjPnbIHemTOtJ:A/XgskNtjf73N18RjTI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781641804, "uuid": "5a2440df-054d-4fc8-9064-9777da91e947", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781641804, "uuid": "95be093a-ea98-43f9-93c1-66720cf7ade0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781641804, "uuid": "4b8ca6bc-250c-48dc-bda6-81db77e249aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f1e2a3-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606820, "uuid": "0b154492-42eb-4517-98b3-ff59201aea82", "comment": "Malware payload (Kimsuky)", "value": "decab741dc4b7e05796dd3ccc7eeaa5f", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606820, "uuid": "9bb97d2a-b36a-48a0-9451-3b5f1c5caebe", "comment": "Malware payload (Kimsuky)", "value": "c51c984a00eb7c833585353ac010f1546026e8924f27b6d0aeabd52a7d16b590", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606820, "uuid": "0850de79-b451-42bc-af87-1950114c236e", "comment": "Malware payload (Kimsuky)", "value": "4dc28948972504e8fdb9a63e9d94ce26bdbf78dd", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606820, "uuid": "515ac3ec-fce9-4b70-855d-706e3f936cac", "comment": "Malware payload (Kimsuky)", "value": "075eff1932b6637f302266cd1af568ff5cce8d0590fc1a467c3ca58662fbd561e4123de30e5bbc44802b8b7f9ea891b7", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606820, "uuid": "29a459b1-079d-43bd-8fa3-77db462e5435", "value": "T140A36C2E7E3BE306834FBFFE06CA1143B1C06FD5716ED132A2C94F595492561B28A25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606820, "uuid": "452e2f76-8ba1-464f-8693-1891731e3c94", "value": "1536:wvuMraKC1kFuKfTa5ZJhOgzitq+pTmuk3iAdLWSMUC9YtfZqYSdXBIa99ya:wvuf19KfT2htzoqU437dLhWAfZqYSBRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606820, "uuid": "7348188d-ed65-49b7-ad47-781f84438ce7", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606820, "uuid": "53d9984d-e741-44e7-9c80-29cc8927062f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606820, "uuid": "ebbdc691-aa12-48ab-90ef-1cd81c8b88df", "value": "c51c984a00eb7c833585353ac010f1546026e8924f27b6d0aeabd52a7d16b590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd24a8c1-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781625840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625840, "uuid": "2edc1cbd-7033-4ab9-98c5-5fc1a1193850", "comment": "Malware payload (RemcosRAT)", "value": "b3fa4a4c9502adb8b198328b9aba28b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625840, "uuid": "aba0ff55-c0cb-45d6-90e4-d377d1b12310", "comment": "Malware payload (RemcosRAT)", "value": "c52315c118626b36dd8225235b0d62afe6a75565eab7cdc498b13e513d664666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625840, "uuid": "c126c86b-a312-499a-ab3d-e62aead152ea", "comment": "Malware payload (RemcosRAT)", "value": "abc1e81d8626566ad953ff1a25f478c329675141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625840, "uuid": "e72bbdf7-4f6e-452e-a759-ef982dd0646f", "comment": "Malware payload (RemcosRAT)", "value": "879f6efd78c1b9b2131e855ecfb381a2466ee91cfcffe0af6544a80b070cd6e6d2139e7a4164bab58e86b8e872f1c702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625840, "uuid": "f6f828e2-a0d4-4b50-bc29-3dc6cbbf3efd", "value": "T17805183CCE54402FF8B2D918C8A5494FF882259B262CE94B91C76F5F6E7288277D235D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625840, "uuid": "166b2639-ed27-470b-a7e6-cf4373618842", "value": "3072:t5o3bZQ3M90POyxjk7DUVvOW+Gu20OW/nCIHqjhGGFMAMsfsg917wBYYevKVNeLN:i23zZOW+Gu20OW/BOrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625840, "uuid": "8a73c443-76cf-4339-b509-eab92ce48ca6", "value": 837318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625840, "uuid": "0bcb7802-8ba4-4117-9a61-4196a4dc699e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625840, "uuid": "b251aae7-fe48-4fde-a962-7c7468f62f6d", "value": "PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d38e003-6990-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781620418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620418, "uuid": "2c4999cb-3609-45ac-aeae-8667d66cb9f1", "comment": "Malware payload", "value": "762a1a8cf38447f4950279aed11dc2e7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620418, "uuid": "6c3b7677-1f9c-476b-a2cf-37b831a1f472", "comment": "Malware payload", "value": "c5544517f1be9d5a721a951d906b26f9ad11adf4a06c3660a75e89f07dabb8aa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620418, "uuid": "b0c5acc2-ef37-4fb8-80bc-cd6eecc07904", "comment": "Malware payload", "value": "fbf94c214a27b6ddef8e31db0d94cbad03c01432", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620418, "uuid": "b0ea5754-04f0-400e-9bc5-6d08dd3ece9f", "comment": "Malware payload", "value": "dbb0f89b39e3a80e10b3591aebc9172299b041a574f43e0091f71e0c0b2a1efff52900e3e5c7f2bfc50a17dd7d83edbe", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620418, "uuid": "e38aec6f-76cf-4b39-ac05-1fc41cea81d1", "value": "T19A562382EF52D82EC4B384375D93063621669D1FC783A34794DC3A299CB7AD84FC9AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620418, "uuid": "052e2fb6-004d-45ba-8f96-689fee99092f", "value": "98304:anXmCCBIS+lxp+4GdEw0XDRrCAn+83tnJGyUC3fTcOdPsrdA:2+HStteAn+8xdvbPsJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620418, "uuid": "bbf086d1-2537-4eff-9e46-a370b080b32f", "value": 6462661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620418, "uuid": "2c4646e0-ed84-4736-8ebd-2a9acb871dcd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620418, "uuid": "11596b0e-cf00-4b3d-aea8-f9c728128d20", "value": "\u0422\ud835\udd5d\ud835\udd5c\ud835\udd5a\ud835\udfd9\ud835\udfe0+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a8943d-698f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781620167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620167, "uuid": "90981e08-4d3d-44c4-8b3d-b0ff09117575", "comment": "Malware payload (Mirai)", "value": "cde9ab177b69e1793d15e998db3b2513", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620167, "uuid": "1dc2768d-4440-4739-a8ab-ab1a1e381a0d", "comment": "Malware payload (Mirai)", "value": "c63b47095f578d3c41ebd963132fe82fea35101df740ffa3302e7802d1ccb94d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620167, "uuid": "bf0cf1dc-b917-4b29-a613-5296bb1bf2d8", "comment": "Malware payload (Mirai)", "value": "604a865c32d35ccfcb98f35011e080648b8fd773", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620167, "uuid": "4b7053d0-39bb-4161-8c4a-505dbd3e3865", "comment": "Malware payload (Mirai)", "value": "a2d7d7ed33eed21e39d37e38a7fa13898f4ef98684d312f8cb18b3c56e801becdc2e1324e34d91fcf2524dc0071bba98", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620167, "uuid": "af4824c0-9b43-4402-966b-eb33723c2d55", "value": "T107E0DFEA782829664616CEA4F8B28963712FEBC42065370CE6CC322B88A4500B870EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620167, "uuid": "b9f76adb-301c-4c26-950a-b3f82432febd", "value": "6:N6J+T5hvCphv6uThvKa0LKi+9hvxIXEhvceJ+M:N6J+lhvUhv68hvP0LKlhvi0hvceJ+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620167, "uuid": "6c3365b7-8d4e-426e-9b81-1a171d331c0e", "value": 321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620167, "uuid": "0ce36ae0-eddd-4f7f-91ae-9d7840ca5968", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620167, "uuid": "2cf62e0c-0be2-47cf-9dcc-45fa800d932f", "value": "giga.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8243de56-6929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781576242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781576242, "uuid": "c46691b9-c454-4afc-9e5c-001c58e31e97", "comment": "Malware payload", "value": "c46308c4e7af97972e178e49f75f82c1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781576242, "uuid": "201844b4-2a92-4776-9ca8-b29beaf7dd00", "comment": "Malware payload", "value": "c73399fceb767ad85b497a8a102dac689a5fdcf0cf614b863e4d08904f63fca8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781576242, "uuid": "a958c6d8-9e7f-4a0e-bee3-92b6597afcfb", "comment": "Malware payload", "value": "0f2696fe72ac8679beec22164521f3ddda33265d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781576242, "uuid": "1f951d3f-7a41-4ab5-ba06-bdcd74356e7d", "comment": "Malware payload", "value": "759e7cdbc2d9ebc8ddb96f70708b49e51530ffa9e64c20abfa6f1c1ed93546512007082ad97b75653a74f29b640dbbca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781576242, "uuid": "375b6406-17d3-475c-88cd-4abda8c2dd62", "value": "T1A5D097A3B1F3027420720A48F1C2E840B916C73EEC04CA28BB1B24709F40348F4C03D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781576242, "uuid": "d9a2856b-3310-4584-a2ed-39071c8b2a41", "value": "6:hT7/I2CSKwEOAHAulNXYq9DG+NjVsNXYrkJ:VT5EOAHPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781576242, "uuid": "6211b49f-024c-4046-ba02-17b2f01c4b21", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781576242, "uuid": "4f72d1f4-b0b2-4cbc-80c9-a65ec913f8ad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781576242, "uuid": "aef557ce-f5f4-4631-a74d-00eaa50ab2ef", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704fe327-69cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781646220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646220, "uuid": "f69423e7-ca29-4a73-bf93-83e04b99e75d", "comment": "Malware payload (Mirai)", "value": "beff7fd34c36d0d517fc2709be1499f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646220, "uuid": "dd6da531-204a-47cd-912e-aa4cbeb5f80d", "comment": "Malware payload (Mirai)", "value": "c75d956a79b76fc12f60f86523b4ae085a785c3cdb5c51e5c10dbfd8be93a3a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646220, "uuid": "25778e6f-3cfe-4e21-8b17-e5b873626d11", "comment": "Malware payload (Mirai)", "value": "f4c0b22001a36c1731639c4f2e931d52f4ecd569", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646220, "uuid": "0516b303-5e3e-435f-bf2d-b5bc1fff8922", "comment": "Malware payload (Mirai)", "value": "b02ddf9a92fbdac4ccaf0769aa7bfc301a9b11e6bad7ba5a262b0222b22c6095b95aa25dd1a6e8d923d0878141339839", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646220, "uuid": "9da9d570-7024-4801-9179-f4e90ffab2d9", "value": "T1D8142945FC919E13C6D562BBFA5E428D372A13B8D2EA3103DD215F24378A96F0E3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646220, "uuid": "550b70de-8828-4dcd-9b6a-d4e6afb6e488", "value": "3072:YxN8uoFKTqy/rJiFrnD6iWWLSOxhFP6niaqfO1Z4uARZ0HD9sXABg4:Yx7o4FTIFjDFSOxjPCykZ4uoZQCXAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781646220, "uuid": "6056c6c5-b5dc-4b60-9925-52716d267b5f", "value": 209184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781646220, "uuid": "62f98894-2b66-4ac0-80bf-1ce61956f083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646220, "uuid": "bb36efd3-6484-414c-9a62-3bbe7bf270da", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02b0986-69c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781642918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642918, "uuid": "9bdd310d-54b7-4325-89b7-bb8f40cecfae", "comment": "Malware payload (Mirai)", "value": "acd2ac345072e110fecc8abe17e1d39c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642918, "uuid": "07f6eb4d-c893-4677-b938-7b1a95d79912", "comment": "Malware payload (Mirai)", "value": "c79d014d96190bd8f1e2c51655e6f4d9b5f91ad2d24c18ed26dd73756c8940cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642918, "uuid": "4dc1a3cf-3b27-4a1c-a633-3f0059b0a47e", "comment": "Malware payload (Mirai)", "value": "18e819b8b466581ced641c7516f667456aff012d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781642918, "uuid": "6031c26a-fc00-4f8d-a20f-ad89555a6948", "comment": "Malware payload (Mirai)", "value": "28aa85593ea2de65cf9cf378cf4f7a271b15231ad1e3cc2988a0bd94386e1e73bba26a6b42ffbbf996117fab09fd58cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642918, "uuid": "9909de05-c52e-4ed3-b27f-933ee24986a8", "value": "T1BBF37D81F743D4F9E91A41B030E7E7379A72E439002BEE83E76C9E36AC92541951B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642918, "uuid": "36d3329f-a621-4d95-aba8-ee9673f53380", "value": "3072:zJt6cNDTaryZS+9cotE1zE+CyzMg4TNxZPs/qwBTZ298TZQ8gPdtCGdHAz:zJt6c8+k+99tMzE+Cy4giLZPAQJFtUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781642918, "uuid": "4199c2bc-f727-4678-84a4-9399dab71b56", "value": 159944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781642918, "uuid": "fa926c09-0de9-4cd5-9967-e1027e0060f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781642918, "uuid": "6eacb0c2-94f1-44dd-a2e2-caf210908002", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c483ab-6976-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609262, "uuid": "dae73624-00a3-435f-adeb-1aade6bd020a", "comment": "Malware payload (Kimsuky)", "value": "39a71c07c4afb54b8d527a5e4f333e59", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609262, "uuid": "dbf7173b-98bb-49c1-b1b1-c0f2b70b37de", "comment": "Malware payload (Kimsuky)", "value": "c7a188ab266894b9e7835d44ae4f118cf45901794f7052d1234df3390c284f43", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609262, "uuid": "7c6fd6d1-fb26-4808-8041-dd8bf0dbfb78", "comment": "Malware payload (Kimsuky)", "value": "35a01f5e739d8305f1e31f3c8a686f31106898cb", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609262, "uuid": "4d63136c-23f5-4a69-89de-360cef89e83b", "comment": "Malware payload (Kimsuky)", "value": "94ad0ba42313432115c5e54f23f33cf6db7cad9b6b3faa882fc5ab724857b2adcae6151fcaa1b9e766cc8021c71b3274", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609262, "uuid": "77dda66d-14cc-4040-a64f-41e57596807f", "value": "T1F0A1A4877516C3C623C2D243B7EFF58D7A08866D00BADCA0F4AF461D2355D5562B8AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609262, "uuid": "04884a62-986f-4bf5-bc71-0d5a3413dd7f", "value": "96:SUGimW4TADqgA19ebquyXRuIz4zrWDvgp+In+AuH0zQlb:FGxW4eyXRjz4zWO+In+AuH0zQlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609262, "uuid": "2cf368a7-141e-4309-a08a-760626b3b0a8", "value": 5047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609262, "uuid": "8a31a1d3-c38a-4ac6-8b4e-36918a58487d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609262, "uuid": "2c4e3a92-4237-4c28-9181-5ad5baa7261c", "value": "c7a188ab266894b9e7835d44ae4f118cf45901794f7052d1234df3390c284f43.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0645249-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781607726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607726, "uuid": "b71eb4c0-6fef-40a7-bef4-36b81110bcd5", "comment": "Malware payload (SilentNet)", "value": "5aed50da2b945077b3eb6a48e30feb1e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607726, "uuid": "24e4056f-5130-441a-b6a7-dee78cd23bfa", "comment": "Malware payload (SilentNet)", "value": "c8bff38ce0875171b0cab8138b6f0405ee4664bf924b059bc2a7c68a30971246", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607726, "uuid": "097f1aec-7995-4463-8144-702be87ff8dd", "comment": "Malware payload (SilentNet)", "value": "5d5e408cc6ee14d4d1dba4cac86d66d395f6d34d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607726, "uuid": "c9a50a03-80cb-41a9-ad88-7841c91a5a3d", "comment": "Malware payload (SilentNet)", "value": "b44d21321c56fd17dd4535b245d3aa79de680c315a606cbf65b45fe14df0668df1f477ca951ed7a7de120d6fa2714969", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607726, "uuid": "f3d27f3b-11dc-4f4b-b502-454544ec5189", "value": "T1E5E5237ABEA5D134E91B1031451BD9B3302502C6E197A6670AB70D4B4FB8D9F070BAEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607726, "uuid": "e19db1ed-57ef-4a61-a724-3360288a8a3f", "value": "49152:wIyF/jMYB/xEv33eFiT2nnvJGD8UyF/jMYB/xEv33eFiT2naxEs:x2j3EP36vnvcD8U2j3EP36vaCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607726, "uuid": "776710de-32a7-455a-b1f3-b8d5ed112467", "value": 3313107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607726, "uuid": "ee2ef0a1-3661-48b6-93f0-fffce925c3f6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607726, "uuid": "7d04856a-745a-4551-be77-106c54464d3b", "value": "Astralux (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d085c3a-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625599, "uuid": "a8c46078-45e3-47c9-aa2e-8d1be208ff7f", "comment": "Malware payload (Mirai)", "value": "01c5914041d601ad18c028d46bf899b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625599, "uuid": "2c316a43-d0cf-42e2-bc4d-6eac095381a8", "comment": "Malware payload (Mirai)", "value": "c8f99502782a92da92143a2d77d5f90f5167a1ab3cd59ebe4fe4815e40a49aa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625599, "uuid": "ec64ad9f-6b39-4ff9-9c2d-3e3daec7f20b", "comment": "Malware payload (Mirai)", "value": "64ab8cf46f4f48bd20ddc617664da39899d0e428", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625599, "uuid": "d1194627-c5a6-4c31-a158-0e147b27f6b7", "comment": "Malware payload (Mirai)", "value": "5d6ac6a08ec120dfea9e7e2f6a7dcbf97a3c32da4a6b5c2e18e406935f3d4b5164c0ce012f70549e15f4eeef0fbd919c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625599, "uuid": "a57aff10-3ff2-4715-921a-618d603d5e0e", "value": "T122033BC4B903EAF4ED1602B12037E7365F7BF03A216ADD87D359A5339892A40DA472DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625599, "uuid": "ab8b019e-981c-4117-bba2-fe8e49ffebd4", "value": "768:AKm8CBGlwXo6gwpqpW0XZjS5bDKCvrDC1R9sqjM73FkG:AKngGlwXo6gyqpW0XdS56mcrjM71kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625599, "uuid": "84a24564-c30a-4322-8c48-d99375b57862", "value": 39804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625599, "uuid": "a6a5c37d-94da-4df0-9e71-12b68efc879b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625599, "uuid": "76798ad2-afb5-4231-88ca-ce3689750100", "value": "a802ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407e4cff-6976-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609203, "uuid": "7ab792ee-87ea-4072-8b2d-dfc58197dd28", "comment": "Malware payload (Kimsuky)", "value": "664b6cf7f7048118e9a6d254e48a9900", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609203, "uuid": "44ea1117-668e-46b7-a9de-9ad09c8958b1", "comment": "Malware payload (Kimsuky)", "value": "cb87510df929d72c5543f7e4538b84570c98a8d32c8e2a5c51344bbf85630646", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609203, "uuid": "3bcaafe7-9a76-4590-ba49-c397bed89200", "comment": "Malware payload (Kimsuky)", "value": "a6811de49158e096c9f122c192188f86100dd9a9", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609203, "uuid": "8bf986cb-3109-49b6-a954-1357c267ace4", "comment": "Malware payload (Kimsuky)", "value": "dbd13af289c3aff20da5144a88d2a2f64e940b66c419705105c8bf2c53eeb62a07d0fa693f70c284a2cb197207ff394a", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609203, "uuid": "0d06aa5d-8c6f-4dc1-9ea0-87e7cc92db18", "value": "T1E9B177973046C3A7A7C291837EDBF5C9320CC8A940FACEA4F8FE061D5358A5B7179259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609203, "uuid": "5ca05431-6512-4614-94f3-2543fb966599", "value": "96:oFJmUyzhcURdAQ5IzHWkrumA19tgyQgwJMQS3ZQQfAgeCmhAoCMPp48AJWNLG+2D:aUlhcaDIz2krMlQOvZFz4CH8AJOLZ5IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609203, "uuid": "50c42283-b05a-4fb2-a2e0-7e8094d169b6", "value": 5121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609203, "uuid": "d8064707-39a9-4dcb-98f7-86edf62d8c86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609203, "uuid": "71c45d67-a58b-413a-b24c-ab261fdc191b", "value": "cb87510df929d72c5543f7e4538b84570c98a8d32c8e2a5c51344bbf85630646.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2a29fc-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621862, "uuid": "4fc22a0e-815d-44c0-bcad-91fa2c7e90fd", "comment": "Malware payload (Mirai)", "value": "e77a965fe2f7eca2c4fc0b1a9306b4c0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621862, "uuid": "a4f76742-8bb1-4417-971e-df273cff389d", "comment": "Malware payload (Mirai)", "value": "d04bfb2709c199112d17a187a7830085bc230fd9a2e9d85b76d05655dbeb31ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621862, "uuid": "07fb7714-cc39-45fd-afe4-106cc5bc6a58", "comment": "Malware payload (Mirai)", "value": "971b63567905a63b0583a686c59f23a397d75329", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621862, "uuid": "8e271336-0081-47ff-9890-792bf40ca055", "comment": "Malware payload (Mirai)", "value": "e628ab0a0dc631cade7b0acffcaa64d230b0fa5eb1ca6a7717cf99266f28501a49e2e73f8cc78cc67c67ad4f2800cbd9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621862, "uuid": "e4f00a32-58d8-4373-ab2b-f85387b83f0c", "value": "T1BAF3C80A9F610EBBDCAFDD3706AA0A4235CCA54722A43B763674D538F54E50F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621862, "uuid": "d2f2ffef-b732-4f27-bdc7-c0f5d35abd04", "value": "3072:Z/9LdJIE7C2E+5mS7zME6uJjleZXFGJo:vd9ZME98hFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621862, "uuid": "eb29e3e1-c693-4717-97ff-999c29316493", "value": 161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621862, "uuid": "c522710f-22db-4627-bf6b-33789741dccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621862, "uuid": "f353bd0a-d93a-487f-ad75-6f500aaefbbf", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a0d9b4-69d1-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781648460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781648460, "uuid": "1d927b65-2875-4226-899f-624587e99752", "comment": "Malware payload (LummaStealer)", "value": "0fe35ce71b049eb3615d35fe5cecf094", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781648460, "uuid": "465da88a-d6f6-4410-ac4e-4bd2fa94233a", "comment": "Malware payload (LummaStealer)", "value": "d06c8ee46e760f390dc48f0fa7723e1499998db0801881a3265c2ba3db91882e", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781648460, "uuid": "592cd9cc-4c30-4c8a-9da7-d38743c2e40c", "comment": "Malware payload (LummaStealer)", "value": "d8d2a0c6b4437b262e8bcc70253674c788551cf1", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781648460, "uuid": "60bfa515-4783-44fe-b1e9-aa6ae9bc47f3", "comment": "Malware payload (LummaStealer)", "value": "3d4d773c7d985894d82892ce5c973a2cae6ca8ed23652297df2ecb371e6fe27065ccdc2185033a95420b6b8d4297141e", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781648460, "uuid": "ac3facd3-f4ef-4c24-a926-d37e982b636c", "value": "T1BE376A04FDC758B6E402567188A762AF23399D050F36DB97EA843A7DFD772D5083A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781648460, "uuid": "f7c7f677-9243-4e7f-a9d4-b10b2239a6ca", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781648460, "uuid": "c72f60e3-05df-433e-b1d2-a8cc3edcd7f1", "value": "49152:svy9WlCqENrGZDoOF4ZTHXC9zI05LH7PO2bs/FxlhUR:oxlCPNrGZD5MC9I0sR/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781648460, "uuid": "7f83e1e2-ff6d-4666-9da1-b635532bbd19", "value": 23923592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781648460, "uuid": "7bcbac9f-6156-4543-aaee-22f7c184679f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781648460, "uuid": "bf94645e-879e-47e9-9deb-38d6815b83fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9ab7c4-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623044, "uuid": "97df9f3a-c67e-43bd-a3da-b2dfd148b271", "comment": "Malware payload (Mirai)", "value": "7474a6665eb64f154b4a5a667427b942", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623044, "uuid": "a22e2950-b4f1-4158-9245-2cf0b90d6d9f", "comment": "Malware payload (Mirai)", "value": "d12c2b8b6ecb6d2c2541254394e0b346268c54e613d1e0348c242f08c2a765da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623044, "uuid": "e3ea4dfb-8fde-4386-9fe7-1ac220568bd3", "comment": "Malware payload (Mirai)", "value": "1892fb03d23a8e60c5a7bf4e1dc5f17d9893fc89", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623044, "uuid": "48c093e7-caa5-4857-9fbf-a22bfd78ddf5", "comment": "Malware payload (Mirai)", "value": "803d49a369d45434c5360bc8a12914d335f935bcb0fc150590e3229220e83d5ba7495676cee868b6fd39ebb07ec6db41", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623044, "uuid": "c128e0d7-c443-410c-a7db-945ab7b37975", "value": "T1F021F00AE2486D8FD8A7157C142F06263420360AF4138122A3768D7F7A776E4120A18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623044, "uuid": "81c847e7-d8cf-4aaf-800c-a4a8d5f20dac", "value": "24:3va8DzSWPpbP78Pwy74+CiLHEVhHvJ+D8ECAfG1ioQqRNT1oB0:/pP3hb/mZihPJq8DAfh0NhoB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623044, "uuid": "b1dc1828-33ea-4807-87ed-ebdbe8fc7ddb", "value": 1256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623044, "uuid": "918865fe-49ba-4e04-a092-5626ca256e16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623044, "uuid": "c36864f2-9f6a-43ed-8c45-b23280b61c5a", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ec5d18-69a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781627940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781627940, "uuid": "b2f944f4-dc59-491d-80fc-978286f9d33a", "comment": "Malware payload", "value": "1327180744ec7dcf7f61e6b7b828df26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781627940, "uuid": "9920be95-538d-4e0a-a2f2-d06e1710a491", "comment": "Malware payload", "value": "d1be4715dd7aae97adab8125389b08e75f83ceb8078100a5fe43806ee7da0a99", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781627940, "uuid": "d3317928-5103-4aa9-a10f-3e4b9d7d7951", "comment": "Malware payload", "value": "d9d0d4519d8fcb32ac73adc8e1e6100dc4f4f62f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781627940, "uuid": "3b210de6-6e2a-4e67-a0c1-6bd9d0d89ffb", "comment": "Malware payload", "value": "ee54bd68b25b3b3de7d55d97be895a5d3d3f7e6b0fddae70c0f94e439c25e33f6184e89722e01751e35010bb9e280c7e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781627940, "uuid": "48fe8556-308d-4281-84c3-aa54d26387e5", "value": "T1D7862341EB19D4AEC0BB5A338A7251744183DC6F8393C6836DE9B33819B71C56EE5EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781627940, "uuid": "677bf708-5b56-47c8-9c74-ebcdf6dc04ba", "value": "196608:qS+vGgF3QQKkHeQic/pGf21yS9yxmEMUB7iCbxuyKsJd:QegF31KieQic/VgS9yxmEMUBWCbtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781627940, "uuid": "35c4a86d-ac95-4383-ae26-0d31ef8b827d", "value": 8553755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781627940, "uuid": "f5029e57-9f5b-438e-abd0-fca224acd8b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781627940, "uuid": "68131bfd-31ef-466c-a3c7-b6e158442381", "value": "\u0410\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435_\u0441\u043f\u0438\u0441\u043a\u0438_\u0421\u0412\u041e_(2026).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfbae9b-6997-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781623370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623370, "uuid": "d0ac0e6f-6292-4e29-a17b-00d06b08c185", "comment": "Malware payload (PureLogsStealer)", "value": "dcad6b0d28491d35d79b9f28728ae9e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623370, "uuid": "4a1472ea-b66b-4edd-a4a9-b692e288bf94", "comment": "Malware payload (PureLogsStealer)", "value": "d313447f8bc9b4e058ca7b3de4cb73f03be0713a730b73cc03a9faecbeb288bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623370, "uuid": "b3bc967e-e490-4d0b-89eb-e7ae62e4f7fd", "comment": "Malware payload (PureLogsStealer)", "value": "89645be5e141a5cb33788b798085a7e649014952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623370, "uuid": "2667673b-9959-4ea1-8fce-c3640775594b", "comment": "Malware payload (PureLogsStealer)", "value": "a91a3a53af4cde5f5011030c90b5a7df4c05c6700e5b773666da74bacaa81895eb2e1c6730398289862a7ddfed9a51f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623370, "uuid": "1d0d3fd0-0497-4183-bb39-890e6de14227", "value": "T163F4BF1B36968E21D2840232D1E7050187F1A94BB677E70E75C6279B29433FAEE4B3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623370, "uuid": "914d2bc2-b0d9-411c-b3a4-359c921b7d93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623370, "uuid": "37efa104-ef23-417d-8b66-842002a62788", "value": "12288:khfe2RdHDEeLTHRlgVlKpB/l8uZTubhFFFh+O/bJuhPXDMQz/jdhq939ES2ulL:kRJTHwl2B+uZTgh5ruhPzMUZheF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623370, "uuid": "1037d4ed-fe48-4a24-af24-6ecc6480edb4", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623370, "uuid": "174e5623-6a73-4662-a481-fcdccd0875bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623370, "uuid": "a4575bc6-0e3b-46bf-9655-68000da9cf98", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.11647795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904f82e8-6975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781608907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608907, "uuid": "90e8851e-4933-4efa-841a-6d21bb11cb4c", "comment": "Malware payload", "value": "c31677d3963476e30fa25a976c972636", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608907, "uuid": "7f1f35b9-c07c-486f-b44f-4fef960ebff3", "comment": "Malware payload", "value": "d3fd81d80f79a69eaed4c1ad2642b4bf9c7236f1f2abbdfc66cf6877a59c6dd9", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608907, "uuid": "39186095-a8f8-4e9f-85f7-69abdab2594d", "comment": "Malware payload", "value": "423006a9212bd5d68b8ae9dd08e9797f085ddd38", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608907, "uuid": "c7fb9d0a-7590-4d37-8679-7006d4f633cd", "comment": "Malware payload", "value": "02077bf38f674fde59648de543962df907ff63b19e21b13507267f9868d0d5e633e849eed6e617b69fd1b3cdbfd8807f", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608907, "uuid": "565f009b-3d38-4f7a-94ab-384d82295526", "value": "T17B2142E6B0238B1A63DB01CF9ADB9110B648C03D549982F0F1AE67A74350A7DEEDC64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608907, "uuid": "ed163696-6e44-4bfe-ac34-f95415591c64", "value": "24:Z2y+O/nhDO/52y/xYVHY2NDAClZTAXlYUISLKrFhSeKCby+fABHO9wuY:fNng52G6nl644KrF/Tb9wuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608907, "uuid": "6507b5cc-4d28-4c66-a0b7-c26789bef77c", "value": 1361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608907, "uuid": "27ebe868-e1b5-4514-80c9-024c053dc418", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608907, "uuid": "1b99a3fd-1fb8-4fec-9273-f9bccee4fc04", "value": "d3fd81d80f79a69eaed4c1ad2642b4bf9c7236f1f2abbdfc66cf6877a59c6dd9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1363f2-697b-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1781611286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611286, "uuid": "e9dc4253-b333-4e56-91b8-177b744c58af", "comment": "Malware payload (DarkTortilla)", "value": "bdf08ce9ab6f348e47f6e8af26af4a65", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611286, "uuid": "1db63f40-286f-4cc5-8179-a7d5c4a43be4", "comment": "Malware payload (DarkTortilla)", "value": "d56bd06a68d33a1d07b75d1caec577a592dc7ea893d34153746b0d4cec21de58", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611286, "uuid": "bb596b41-540b-4117-aa07-3726352d141d", "comment": "Malware payload (DarkTortilla)", "value": "d3919b114fc4e131f769b154db6b6c0b0b8b569b", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611286, "uuid": "dc68e3d7-c465-4cf1-bd2f-972462e06bd2", "comment": "Malware payload (DarkTortilla)", "value": "9a856eb1492eea70e2d83009476b5c53963df8a652eb064f05d8e12c3834c321e61bd65469177904c25f82ca3bebdba0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611286, "uuid": "74b8c125-4ae0-4901-a99b-c95bce7d9501", "value": "T1D315C0386DC68549C6784FB5C6739B8837F1D94BDBC2D30B7FDA20A8892E796C500E16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611286, "uuid": "4d846c72-f9a0-4bbf-a42a-f110bb70ec5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611286, "uuid": "5a1b07be-745b-47cf-b2e0-1206b4019bd8", "value": "12288:ReMW7L/o2adwlzKi3E13hsBEhijE8wpVlSW/CKR15XpN9F5vBAp:ReMW7z2Klb0HsBsxpbrqKR1N9F/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611286, "uuid": "8090565d-c64b-4ffb-b033-3028ab0298b5", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611286, "uuid": "5207a8a8-2a3f-4d4e-b239-ee278ccb994e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611286, "uuid": "272d6576-cf6a-4346-b07e-7fb86a903260", "value": "COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b708cfeb-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606825, "uuid": "9869a68b-f330-47bc-817e-f05e1bad0106", "comment": "Malware payload (Kimsuky)", "value": "4495705ecc4c55f38bba57cf40d77851", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606825, "uuid": "f228fe60-7a61-4358-89cc-00bcf5297e45", "comment": "Malware payload (Kimsuky)", "value": "d5e2866de8ebd72ae91800af1b4abed22c825b8bb23e450c027e91734428a857", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606825, "uuid": "d4d93dfa-ed1a-4a70-aa20-007e1ceddbc9", "comment": "Malware payload (Kimsuky)", "value": "0bbc342a9841a4fb5d176856f4dc3a2bb0ee07a1", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606825, "uuid": "2ee8a684-731f-4b42-952f-df8376feac3a", "comment": "Malware payload (Kimsuky)", "value": "6107286370ef6f9be71a9be2cd1c56153e86ae01b0ea7ee8c154adf4804fb2984f176bc99243f60967473f8973573a98", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606825, "uuid": "229c8493-5910-41de-9d5c-a35bbd315a06", "value": "T15893BE3DF90B93A7C520D56C916B606AFF7A4BD3F56B8B9265EB1B04414080A36903FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606825, "uuid": "106a4900-d91d-463c-8298-6df0569834e9", "value": "1536:SdVLp5VI6QhJd2jI9aVVe8diJpI1UchH2H1uEJrBbBvNHO3y9DVxWD8Z:Sd86QhWjI8VVqMUchH20EJFlNHO3y9DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606825, "uuid": "cef590a0-68fd-4442-a365-db7ee864a769", "value": 97649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606825, "uuid": "6e7a8ff6-d468-4dae-8250-6425c7ab23dc", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606825, "uuid": "5b1682c2-f653-481c-b194-b40d461ea4b4", "value": "d5e2866de8ebd72ae91800af1b4abed22c825b8bb23e450c027e91734428a857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcaf357-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606840, "uuid": "48375435-82b3-4740-a21d-48866c2a0420", "comment": "Malware payload (Kimsuky)", "value": "61c3da005222e11f51d2d65df4270835", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606840, "uuid": "debf09da-7e95-421a-86a8-c3a6f30daaee", "comment": "Malware payload (Kimsuky)", "value": "d68af51d148e388451631750791c9e3b8633433b3a411c89fd1e1390023d615b", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606840, "uuid": "95616782-0639-48bc-a1cf-83e21784fcba", "comment": "Malware payload (Kimsuky)", "value": "7af885a5c92079f4f37bee3efd1dd9d149b73953", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606840, "uuid": "bd4b7443-6816-40a9-991d-cfe6a4aec6b5", "comment": "Malware payload (Kimsuky)", "value": "dc3e4f76090e0962405ed7d6ce7b188059439470f287da4fead6255d508cfd680a056ac6317b23d0240090156dd5f44f", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606840, "uuid": "f458e5d6-ac96-4f72-b407-d5c7c0b5e6ce", "value": "T1AC835B2F744490A2857DCADC4DAAD80BF4414EC37B683D4DB9D3DA86C945E0B30EAB5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606840, "uuid": "f760d325-99e2-468b-b5e8-99d91b2b3768", "value": "1536:Lzl8fiWzDWXPu9NCiRuApua3Bn9eopl378mM593nqF4aNmVmBvy1kK8:Lz2fiMou9HnnwoplpNmVmA1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606840, "uuid": "64dd7b8d-504a-4117-99c1-75d46418e924", "value": 82214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606840, "uuid": "8900b09e-ddfe-4a98-b241-8d7651e1d112", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606840, "uuid": "5eb765e2-8f74-4048-832b-bd6017646ffa", "value": "d68af51d148e388451631750791c9e3b8633433b3a411c89fd1e1390023d615b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9234b8-69c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781644467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644467, "uuid": "257b3a69-5e1d-4cc3-a4f5-bdcbe5816f98", "comment": "Malware payload (Mirai)", "value": "d4343373319f780c22a4826425d96ac1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644467, "uuid": "55a59bbd-d38f-4583-af1c-b73e63defe9d", "comment": "Malware payload (Mirai)", "value": "d6a84f65af7d0f475932a71c5ba2827330ce0b31fe00f7ad4074b3617cb56b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644467, "uuid": "8d0acbbb-4421-49c0-970b-4752b2bed636", "comment": "Malware payload (Mirai)", "value": "f3a2e84751df9a36a352fa34e514164ee0f1b88a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644467, "uuid": "d48134ab-91fc-476a-9a49-a8dde9ddf331", "comment": "Malware payload (Mirai)", "value": "289ba3d151b043bac0a23f0acf3aee907f64f77ecfdbde71e65b8aabda2c5b2f219814e0bc2d1c3710454fb9a9d0faf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644467, "uuid": "11d61892-28ed-4d32-b9a7-58dbd35e3db8", "value": "T13EA31228EA051A71C77268A15CF489B637C29F37F29E507F42ABC108D49D4A9C27E1F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644467, "uuid": "92dfc4ab-4d53-4309-bade-304ce7e4020b", "value": "3072:RwzFQsQPQqjbFWChPz925/cJbYLs5ohI44EVAX:5sQhXzccJMLsysEVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781644467, "uuid": "2e196fba-62ab-41fe-b73e-d2eab96230e3", "value": 103948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781644467, "uuid": "1bdca9f2-eb12-45bc-b370-ae449ae3e0a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644467, "uuid": "15d1a1eb-1432-4b2f-ada1-d7d5ff482078", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796debd6-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "137364ac-df23-470f-a4a4-197eedfd150e", "comment": "Malware payload (Mirai)", "value": "4fff15e977408cffd46568066d280de6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "34cd2621-d91d-481a-b37e-65dedf648325", "comment": "Malware payload (Mirai)", "value": "d8449981612df2a8702a5f3050a0be188c07122ff6376919898e10fa6210e0ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "6d3ee201-017f-4912-9dcc-0448e5be364d", "comment": "Malware payload (Mirai)", "value": "5cd60b37cdbce19bb685f736aed5ea4ed110ec67", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "c2a3ba43-577c-4e6c-8eda-db9048e55504", "comment": "Malware payload (Mirai)", "value": "797d2e9afb1db2f60846b1c14d98eac4eef597658d6f96e22c4fb47e20acc974ff0d55b2a7e5dae8f0aee0903abeec80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "303c9d17-8882-482d-ac26-bcf8d19bf469", "value": "T1D531449056D05EBCCCF481BFAD96071173649F84E0C772A3951C6718BE2AE7C5C17046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "2fd43eba-9c9b-46a7-9ba1-d45ee676be4c", "value": "24:vKGpa7Urz/jlfcAXK1YH9Vev3gRGRP9iMfnBBuLNoVlxrR+zz2KpQt:vKGpa7UrLZKdlPJBuIlxrszLpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623042, "uuid": "b4e5c107-4f23-4f7d-92e6-6aa5a12e4319", "value": 1460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623042, "uuid": "5e4b36f7-794a-43e6-bd67-14f359cb4204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "b65eafff-05f8-447e-8987-63ce73d38484", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170ed1d2-69d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781649077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649077, "uuid": "4e9b60d3-38e7-4dcc-b8a2-28790fa9452e", "comment": "Malware payload", "value": "e8d51bbc66d3c6ae99b88b4d9c04e92e", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649077, "uuid": "849d8402-bb0d-4ee5-b01a-3c70d1b0299e", "comment": "Malware payload", "value": "d8b74773bc5ede950797fd834929e6f20e956fe22004151791b23f87a1ea3514", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649077, "uuid": "8a32c52e-85a4-4ae7-9ab2-6270b42f1993", "comment": "Malware payload", "value": "a17e15b21841518d36a793659616b841b3540f9e", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649077, "uuid": "3b921e87-3f34-448d-b820-bdb5a9e051bf", "comment": "Malware payload", "value": "f973482088a3c4ed50d73179b1f72d4e283a912dc9c3dc10aad8a6e490c16779d5b8bf39e8fc68b4f37678a61daeb633", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649077, "uuid": "b8713804-e0be-4afc-9dd2-a3244e8b5a77", "value": "T179F41A80A9AB4CF0FB069CB3A115E36F775995189C14C6CDEEFC0A56A9F6F40824D4E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649077, "uuid": "fd3ec635-a04b-4f37-b4b1-83b7fa6659e4", "value": "24576:0aP6mYEg3fQ1glegqdSGyM+bu5SE/4A/cd:3PMBebm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781649077, "uuid": "9b9353c7-98f8-4621-a35f-8a239fa899a8", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781649077, "uuid": "64d74394-d02d-4bbe-b760-207d7c7b093f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649077, "uuid": "5522b2cc-f754-4e0e-a1e1-5eb2ff16f68e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69137c2-699b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625346, "uuid": "b91d251e-feb5-4fb9-959f-a9f8169a7e2a", "comment": "Malware payload (Mirai)", "value": "f85d36c6f0dbb5fad308bcc0a5e1ae83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625346, "uuid": "c8ab81d8-d04f-4373-996f-b1a3977e8d47", "comment": "Malware payload (Mirai)", "value": "d8d60084feb7de3e0f0bc9ffc4ad52ef98b71403f17ce004d6e1cacf082738b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625346, "uuid": "f5b67a32-e78c-4ebe-81ce-c40a04a870cf", "comment": "Malware payload (Mirai)", "value": "7665e46c5a8154857112ae9e78b8b039c7e78d17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625346, "uuid": "eb046f55-7fc1-4e12-8e8f-2f86d7df102c", "comment": "Malware payload (Mirai)", "value": "fa6503eabd0f8e3f29f094e6a23aee542f8daaeefff2fc4686aea8940e73594d173c3c4faf1f98d199143d9498de5048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625346, "uuid": "dff25ddf-7ac8-4821-a844-f002c4c58411", "value": "T178243B45B8819F15C6D016BEFE1E128E332717B8D2DE7212DD206F61778A96F0E3BA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625346, "uuid": "67b20728-bf85-4f5a-ab14-b8bfff884818", "value": "6144:vQcVCT8V6SPwzYpxeXfgLaSM5btPfwmM:/aQrneXILa79tP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625346, "uuid": "c37f8135-f0ad-4424-9d4a-849288036f8c", "value": 221468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625346, "uuid": "fc27bded-ed1b-44c5-a646-f77e3830cead", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625346, "uuid": "a1119fef-4ae0-4e21-a696-ce7857c2087a", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6daac27-6969-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781603872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603872, "uuid": "d75142a2-694a-4d19-924e-ba920fc261e1", "comment": "Malware payload (ConnectWise)", "value": "c0259b0210de1109edef3eb814e1575a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603872, "uuid": "a16b5dbe-c540-493d-bfbf-284b1ddf766c", "comment": "Malware payload (ConnectWise)", "value": "d9532a6706ea786a8ca1a39980eb6094a11cd233838032518201a84e43a0b584", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603872, "uuid": "1c296baf-deeb-4928-b534-2e6e3f46357c", "comment": "Malware payload (ConnectWise)", "value": "5378cd24fbb6c548bdc08e320b8f7de8a994774e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603872, "uuid": "ac3571fe-59e0-42d5-9cd8-65889c760392", "comment": "Malware payload (ConnectWise)", "value": "c5e98430812667336d8f6f15b602a33b5f42aabc412bafb07b49efa8365b38166e50bca6d8dc6c41512e64063b1fc634", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603872, "uuid": "b392a3e1-10b9-440e-919b-60a82978db44", "value": "T19C46F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603872, "uuid": "66280bb7-9f5d-4f90-8700-8905db191959", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603872, "uuid": "20fc1ae7-f0ff-4ed4-ab1c-0e26278d6a08", "value": "49152:gfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:nrs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603872, "uuid": "0ac4e144-26d0-47de-a173-df15b9ea6b28", "value": 5648376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603872, "uuid": "6987e62b-1acf-47a3-9637-6af6e5986fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603872, "uuid": "0796e6ad-8126-4b22-a96c-b42371777ea5", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93e1017-699b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625297, "uuid": "a4393750-3da7-4591-8f97-88649656818b", "comment": "Malware payload (Mirai)", "value": "44acb2e813928134e2612efe7410856a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625297, "uuid": "119c43f5-7395-41af-b6c1-17d719aab345", "comment": "Malware payload (Mirai)", "value": "da89b594cf205355ea1fb08c0d63b39cf30b266a1c1bc3136808b5be495d10a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625297, "uuid": "41943b3f-320a-4490-a57a-9ffeaeba869b", "comment": "Malware payload (Mirai)", "value": "67239ea5b41c72c177ed989dac11f492557a0d85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625297, "uuid": "47e8dec0-8cd7-452d-a583-f0f11a098a56", "comment": "Malware payload (Mirai)", "value": "f8bdec75f3b23e979d7e003505c849b940dcd30acadf110c31cd8d3ba5fa5117b01181114138b037040288a4aab26539", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625297, "uuid": "69bdbac1-39cc-402f-a42c-e5cc736c4e1a", "value": "T1948312D2DC096274E4A1E97C787943D66D294AB8B0ED251A00B617C0B8B2F6B8DCD7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625297, "uuid": "4674ba30-4931-43b8-8912-df7813615648", "value": "1536:HUkxckGCQZAXDuatxtNEv3WIPB4aB5n602ADUxZ58h96Tgo7noTLF:HUkykGlZYxLknLn602ADSP8hGr7nWLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625297, "uuid": "3eedcf49-822e-43fb-bd15-d5d488722701", "value": 84144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625297, "uuid": "e7a64792-590d-4bc3-855a-e33250061b14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625297, "uuid": "0a602bb7-b386-4205-a1fc-dbdc8af6f42b", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8ba0e3-6937-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781582405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781582405, "uuid": "1eb55d6e-c342-43c2-901b-307e4749a3f8", "comment": "Malware payload (NanoCore)", "value": "bf598339cf5d38d525d761bf1eb62370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781582405, "uuid": "2640b582-fecb-423f-b5b5-440b6302c069", "comment": "Malware payload (NanoCore)", "value": "daca3e60559b1aa57161573b0498de596866fb4eab3785a09fd6daf03bde2f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781582405, "uuid": "129a5356-2947-4f01-8abf-e876730f37fa", "comment": "Malware payload (NanoCore)", "value": "a8d352ebfdc534dc8514ea6e7fe1ff85a7435a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781582405, "uuid": "f02e9348-a663-43ee-9bbc-6b4b709afc41", "comment": "Malware payload (NanoCore)", "value": "972d4abd44a3f665f8e0c41b15becb3205d9f39014de912a367d7817ee01e1b47c2dbaf91e38b4dcf5c24737ac6f292b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781582405, "uuid": "2974f0a8-2703-4ef4-8127-d0bca8470639", "value": "T10914C05677A84A2FE2DE867D612212169379C2E39CC3F3DE18D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781582405, "uuid": "863f12d1-e7ac-468c-a63f-35d4481c4454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781582405, "uuid": "c336d715-db03-466f-9ce0-411bb4d0eb5b", "value": "6144:MLV6Bta6dtJmakIM5+6V2qhLyNPYTbEjE:MLV6BtpmkxM2uL4YTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781582405, "uuid": "cca5a476-8bda-4fca-8011-0c153717db4a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781582405, "uuid": "3b374b56-e2dd-4d65-ba64-bdbe828d3aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781582405, "uuid": "cc541b0f-83d8-4082-a88b-4dc779424ea9", "value": "bit-one.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9cb5b8-697c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781611747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611747, "uuid": "b67d516d-b586-4b70-ac3a-0455e4e0dd09", "comment": "Malware payload (RemcosRAT)", "value": "ae9c9ebcf3a554f1878e7b81b2105631", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611747, "uuid": "b5dcf5b4-b155-42a4-9466-7352b73db576", "comment": "Malware payload (RemcosRAT)", "value": "dc493320d623d5ee5e9cca8b1eea6154b0839115b22e921c6c89db8dc16fdb4b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611747, "uuid": "9ef8998f-4cc6-451b-a0e9-164d4764fe9b", "comment": "Malware payload (RemcosRAT)", "value": "317ca76cc78c8ca66ef3822163a9beff3b31717d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611747, "uuid": "db7f263c-7c39-4300-8bcb-c37955316812", "comment": "Malware payload (RemcosRAT)", "value": "4b4540dd91da55f7e48d5d969fc2c7a62b1c7beff2d8c60bf6470f7c08a86a88e660f07aa2052994cd102dbe7b9cbf89", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611747, "uuid": "f2243f35-a22a-464a-b248-dfae06343683", "value": "T13DD40212F9A9690BCF5E1F34D793A2F65A05FDA19E2A461F6101734E2DF36D0AD03C0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611747, "uuid": "6edfe67f-8418-4a72-8ebf-2c148103a065", "value": "12288:vi9PQvUJXrQe02kUcyM1Dv/fMmPIeq26v5v23Xjn9S1NJ5:694vUprQ5bQmIev6v5e3JSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611747, "uuid": "9e36b60f-b3ac-4629-aa55-d5d4e085c2bc", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611747, "uuid": "b284edd1-b436-4e8d-a83c-307741e25617", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611747, "uuid": "6c3f96ea-eb4d-4cfc-9520-9606bf51ad96", "value": "Scan docs.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d733f6-6977-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781609687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609687, "uuid": "94a50ea0-ee22-48e9-9c24-e394e8d4c561", "comment": "Malware payload (RemcosRAT)", "value": "e7ff3dc753fa5599d05e1e496a93a637", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609687, "uuid": "b7889418-5ae6-45f0-a48d-c5777f2f6dfc", "comment": "Malware payload (RemcosRAT)", "value": "dcbe38be6ab8d77916b9b3b4f34f754a61cfe5910fdebaf34ce883a8e7a0a8ac", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609687, "uuid": "d8fac248-c609-4560-b408-2c41bfe35820", "comment": "Malware payload (RemcosRAT)", "value": "605e92a80f4472c04c84ca37acfb582c62778217", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609687, "uuid": "10e7bb6c-75e2-4df2-8e3f-f82b4c054315", "comment": "Malware payload (RemcosRAT)", "value": "b915f781db588a74afbf1c6b845b8d8e16c994cc6239ba9f9e23c7c2a2de0f9132bd962dd730f65a16de894e12489f84", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609687, "uuid": "6816f039-4da9-4f97-a06d-9500bbcfb50d", "value": "T16FC21CB69EDF102357A76E1C7E2006C5EBB5A76F98A711083228B7845EEBCDF0590D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609687, "uuid": "bd62463f-db3e-49a2-8387-4d57cff10c27", "value": "384:+Wc0qSDGDED9BrDH52HvwByQg0h3zh36JlPUez:+8GA7z52HCqUez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609687, "uuid": "ae88b51a-7a1c-45de-8271-43ccbd749f0e", "value": 25728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609687, "uuid": "c8a0ac6f-6500-4b72-809d-994758fd884a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609687, "uuid": "90ab0292-40c3-4c3a-b2d4-9bc5f18af492", "value": "verygreatchanceforbetterperformancecomingto.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a62b73-6969-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781603866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603866, "uuid": "a7942f5a-677a-4991-af3b-0f28a85783d3", "comment": "Malware payload (ConnectWise)", "value": "92d67d5f59e1c708af8a4ec0dbe1d8dc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603866, "uuid": "30bed84b-9f35-4105-8745-28d65ff9abed", "comment": "Malware payload (ConnectWise)", "value": "ddaf0d03ed052c9f1cf94cd0ed028129c868e550057cf43826ecc0a45e0b10e0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603866, "uuid": "90fe7d35-d493-4644-b458-0fce1a0ebdb0", "comment": "Malware payload (ConnectWise)", "value": "e15764ce94cb76a6f995207737062662ec5c81bd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603866, "uuid": "7a2ede38-b2da-4799-ab6d-5dac581f7e87", "comment": "Malware payload (ConnectWise)", "value": "bd98afcb40f99a5db7beabf1cb526e44a33c8fe015f3629029b2e1a325b081d17bae2984b23ff75fca1cf910318fe77d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603866, "uuid": "6c1ffdbc-e834-4380-ad7f-e2546b9eec88", "value": "T13646E111B3DA95B9D4BF063CD87A82699A74BC044712C7EF53D4BD2D2D32BC05A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603866, "uuid": "fa67cf29-0ae4-4088-8dff-0733431062d4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603866, "uuid": "0a845b8e-ec3b-4a31-8729-b9a4069d2af0", "value": "49152:kEEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM8:tEs6efPNwJ4t1h0cG5FGJRPxow8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603866, "uuid": "121a3d7b-ce0d-4567-8242-c1f2c99d3de0", "value": 5622096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603866, "uuid": "b5deb7e7-532b-49f8-9ed2-2589e656bff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603866, "uuid": "59636e31-fb6a-4e87-8489-43e0bf0903cf", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e3a70b-698c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781618706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618706, "uuid": "41904a96-fa3f-4379-9a99-57d607a1e030", "comment": "Malware payload", "value": "d7a6d5427c19c0caa44b1590b5b6e809", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618706, "uuid": "654f3fae-28f1-42d5-ad8c-8eb4d7738b98", "comment": "Malware payload", "value": "dde56ba22cb3c9b21398ff19a4e45c20113cfa064fa25819564ec3416b9640c6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618706, "uuid": "924fa534-d219-4b10-8a66-92d0794acaee", "comment": "Malware payload", "value": "25bb5d9df1fe35b14793c64b46221caf6bfd76e2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618706, "uuid": "a9e9686e-3b7f-49c9-9ddc-2d62bf34ad21", "comment": "Malware payload", "value": "56eb1032b290a1a5167994c63dd56db1a15a5abf54d4a763d314d8d9266ef211af95941f0dbd8885b03ae50572f68700", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618706, "uuid": "6d5be736-0ff2-4d43-80bd-73826e70aa12", "value": "T195450CA2DEB7DE3ECB798F314AE68205A7745C52C331CB07A5853139BAD9E20BD450C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618706, "uuid": "da2d75e8-80dd-4ce3-a452-1869233754b0", "value": "12288:GDylH4wSo4A8EVZau7yLLw6OrB7uDylH4wSo4A8EVZau7yLLw6OrB7l/:l+wMEcIdB7N+wMEcIdB71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781618706, "uuid": "0b8dc244-60f0-4ad4-bc49-18f70d0f1dbf", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781618706, "uuid": "a5dd2994-9e76-433e-aa97-ac93b3882d01", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618706, "uuid": "e2e2eac5-6e51-4453-b048-251d9bcf485e", "value": "Orden_de_compra_para_procesamiento.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964828a3-696b-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1781604622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604622, "uuid": "2a11cde0-3e97-4283-bbb9-bb93a7ec3db4", "comment": "Malware payload (Prometei)", "value": "70a5ebe7a2805caaec83d5d67fce5138", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604622, "uuid": "e6d625ae-7b45-444e-ae01-6a749001acd2", "comment": "Malware payload (Prometei)", "value": "de11000225a11a844fafcc0c74e93af04e8d06963851642127372da1a1fd6221", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604622, "uuid": "8e340052-4146-4546-b160-258e18bbfc1c", "comment": "Malware payload (Prometei)", "value": "a1ac3a88ed3b6ad82c206d6787d5384118766f4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781604622, "uuid": "30b50c7d-a9e1-4acb-be83-e8e0e0aac046", "comment": "Malware payload (Prometei)", "value": "4a834b4880b8ad8f09b34b1bb9f9573db497fe33650d50a166f7fc0a3598e46e845f8bbbe3fa21a5809fd719e9b5dce7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604622, "uuid": "db1b12d9-3ebe-4f9d-b55b-a7434b44cb1c", "value": "T16BA423B4F9219E8F6DD769B91B24831DE182C172589D4C2313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604622, "uuid": "ad73eeb4-e9aa-43d9-a0f5-66ae46e47d63", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdM:Fs6pyCC/Ya2hpi6T6N4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781604622, "uuid": "5b21be48-bec3-4d8e-8a7e-c3bdc648c8e0", "value": 449060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781604622, "uuid": "1ca3332c-ceb5-41db-93f6-09243aaeb327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781604622, "uuid": "5d1f7d04-9a33-4cd6-9bde-98b7e34956bb", "value": "de11000225a11a844fafcc0c74e93af04e8d06963851642127372da1a1fd6221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dbc02f-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625608, "uuid": "79510a12-3d5d-4b4d-ad47-6967db3388e8", "comment": "Malware payload (Mirai)", "value": "9c5ddc57c7eae1a13ef2021aabc1787c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625608, "uuid": "790e0463-3081-4fc1-9ba5-62730ce94d33", "comment": "Malware payload (Mirai)", "value": "df5bdee1b0bdc5ddd8c83b7cd9fd2a59fbc6032f204162fdbd9ec6ab9c79a90b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625608, "uuid": "ae0c14d3-ab0a-4f0c-ad24-a6bee6ba53ae", "comment": "Malware payload (Mirai)", "value": "3b145e16509a4cedd0758f9bd2456c33ab4fb7ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625608, "uuid": "0bae5fc7-537d-4b5e-9a70-9c7186d604cc", "comment": "Malware payload (Mirai)", "value": "43cc1db73cbbc20ade8c15ec7f3a9d32aeb53fd6612c862b3d8d0c1f3919fb2d737c253e74d937a6c0d0ec8feb98ace4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625608, "uuid": "8a366e25-55f0-4df8-ad4c-f459aa32102b", "value": "T132131997B801DD7DF81FE7BE84170909B631774550830B3627ABFDA3AD721A48E22D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625608, "uuid": "2f29e85f-7629-44b2-a0a9-9d2c3dd28935", "value": "768:g9eucBjI5pWaWkQNTYoSsZFfsopTkQT93Vp+LBq88Rld75:mXCM5pY1NBZZsoGQT93L+L888r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625608, "uuid": "a563d586-529a-4fc7-b9da-3ec0215f97c1", "value": 44168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625608, "uuid": "13ecfe46-4bfb-4236-ad57-5715f5ca55d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625608, "uuid": "ed77ad89-ad74-43df-8634-fb3e70cc3ef3", "value": "cb2c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e59082-699e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781626600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781626600, "uuid": "65a6944f-849d-4553-83d4-d1ac40a4a6f4", "comment": "Malware payload", "value": "07febe95f6abbfa45a287bf41d9d9eb5", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781626600, "uuid": "7d21a76d-c016-405c-a62e-c8fbd4c68d63", "comment": "Malware payload", "value": "df6068e8572d168939c76d91f9913b696b2da41c49f8fd951211e3907cb2ca34", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781626600, "uuid": "615798c5-c2ed-4e88-bdd2-7a3e8930696c", "comment": "Malware payload", "value": "bce7c9295c070f16e6ef51c5934f4ebbaeccc042", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781626600, "uuid": "b0e63c38-f51e-4736-8ed9-cc1d299cad1c", "comment": "Malware payload", "value": "9b0123e8e54c9913e668ee945523a666d981ea77fe3d83e622a30accb21cb1d972fc6625d995944c98512747475b3ffe", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781626600, "uuid": "dfaf3e8e-48bf-4d3c-8880-8cf0d64a6496", "value": "T1F2F59D53ACD458E5D19933718AB742A177A0F8981F3237E37A98BBBC2EB66D04C35314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781626600, "uuid": "9edb28ed-1e9a-4e6d-aa4f-888d1d8baa82", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781626600, "uuid": "9e758ec8-29c1-4e28-a53b-f841933c7f20", "value": "49152:uxlAIP1EqfuRLAmkN0XpZCkCLQ4FmZDPM:uh84N0ZlCs4FmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781626600, "uuid": "4891a27e-11a3-433a-8ce8-a0d1a62aaeae", "value": 3344760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781626600, "uuid": "902a09e1-b7ae-49cc-add1-b17325f87fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781626600, "uuid": "1659be74-1e4b-4ce6-b0cb-19122c9ea067", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b850c24f-6924-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781574185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781574185, "uuid": "f2d2da4e-c6d6-4d63-a179-93c1f8297717", "comment": "Malware payload (ValleyRAT)", "value": "43fb437c6c181c0f0524c4bec059686f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781574185, "uuid": "4d4c0f66-418a-44d2-a096-2ec60404a922", "comment": "Malware payload (ValleyRAT)", "value": "dfd3f78b3313a33136b499ec4c74594376b83c9df882a410c95a6f41d42f41bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781574185, "uuid": "05f8478e-02e9-4009-a339-69b883dac841", "comment": "Malware payload (ValleyRAT)", "value": "977ad4fa539054df10a43b01b7bee65cab804910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781574185, "uuid": "d86669fa-0eab-4cb8-9860-5524e6d9625b", "comment": "Malware payload (ValleyRAT)", "value": "2ccc097e5dab2d5aa3e73368740c8616d3db256c5f3c16201d229c45249602750d9de9a5ef3160bb26f42f188817c535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781574185, "uuid": "de2c7f1a-8cfe-4a1a-a47c-8340231d517c", "value": "T1C987339E29CB41D9E48014B49B2797F713B27AE94EC4CC7A6ACD3C4974B2FE76039481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781574185, "uuid": "55088946-e8d3-434d-9b07-4ab809919f9e", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781574185, "uuid": "1e624901-2f8e-4778-9a1d-4b59792e935d", "value": "786432:w1jroTCT9I0dQHvvf894P3kuaqf8SH++qJ/GIv/4:+no+I03YkVq0SeDJO2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781574185, "uuid": "84efcbc4-ff75-4b1a-a409-cc8f3ebeff1d", "value": 38771441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781574185, "uuid": "ed7212f6-2e4f-4656-b18f-e13056722da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781574185, "uuid": "e254a063-a3ed-43a4-aedf-0799556c8128", "value": "WeGameMiniLoader.std.7.06.27.1446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f913bcc1-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608654, "uuid": "5a741da2-8a32-447e-8747-153e196032b6", "comment": "Malware payload (Mirai)", "value": "4fd6f6bf64fa93c6938deb84b5c2ad00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608654, "uuid": "dce3fffb-92bc-41ed-a5f6-de193a1acd22", "comment": "Malware payload (Mirai)", "value": "e045615adb803c7446d5ef573e763597fd4723015122236066db302930c0cb82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608654, "uuid": "3062c3c2-0489-41ee-a2bb-bf4794b5f6b7", "comment": "Malware payload (Mirai)", "value": "e4a1671094ccde073f294d4818459b6d6b6f5405", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608654, "uuid": "6035efff-4127-4194-98d1-910ddd03fcd3", "comment": "Malware payload (Mirai)", "value": "c11891cad2c744a981e97f6b3262fbf1f5ea809cefc900f296043f133ea9abc47bc80e60c72af73c463e041f996242a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608654, "uuid": "87c2508f-6670-424c-b922-f3dab09df0ca", "value": "T1A074C63399164992D0508CB212673356AC47C7BF88FA22D3EE565DA4FF3145F22BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608654, "uuid": "41908c21-b01f-4d6f-b024-4b5393f534e7", "value": "6144:eqo98zuloz+GIwD4B2Wc5UVmX/Idso84awTNb:eqoNlbwDUc5kmX/Idso84awTNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608654, "uuid": "a50e01d5-12ee-4880-9e49-16e59b798a29", "value": 360918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608654, "uuid": "e32c8a84-ac08-4db3-b0bb-280131eba57e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608654, "uuid": "0b934e6f-6bfe-4285-a207-28d4f6543d4d", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa17f31-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781650505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650505, "uuid": "a5e36adb-e4ed-4e5b-921f-cd98dee88e92", "comment": "Malware payload (NanoCore)", "value": "515688128526109ab32bfdb63ccc4502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650505, "uuid": "ab4fdab7-5fd0-44ca-b0b3-9e218f9825e1", "comment": "Malware payload (NanoCore)", "value": "e0ae92bd6bb5e2a93c8add7b0368b83dae551c72239286607e2a3c2df54a8b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650505, "uuid": "ae73904a-af2b-4431-8809-dff2b66b25a0", "comment": "Malware payload (NanoCore)", "value": "5e6c23996c447d4e69abf2bf16d10356c88bebff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650505, "uuid": "01d1e597-e854-4f8e-97e4-b6bb1623835a", "comment": "Malware payload (NanoCore)", "value": "9d013a6622e354afd1916a290a0a4650cee52e74e1e60868c6477ee4061aefc9ac0766b3becabe61bbbc9b10ddda1b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650505, "uuid": "2207ecad-42ee-485c-a721-9052226bf58e", "value": "T18A14CF6537E4493EE3DE8678701242029379C2E398D3F3EE28D461B65F667E44A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650505, "uuid": "2d9ca204-e213-482b-81c4-f7115cab15ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650505, "uuid": "64740363-d015-4036-a7b3-a45e8f96b1cc", "value": "6144:MLV6Bta6dtJmakIM526fA+eXcTTacsRy3Cj+o:MLV6BtpmkXuA+eXsaDCUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650505, "uuid": "a7634f54-0f27-4eb1-a279-bc8d90b47981", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650505, "uuid": "58192b01-d0c6-4eb6-bb53-8b80106484a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650505, "uuid": "061ee202-2fdd-4d84-afc8-13db66b98a6a", "value": "beroba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fe0bb4-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605642, "uuid": "799f4d1a-bef8-4058-999e-174b00e40bda", "comment": "Malware payload", "value": "b2dca3014001b78080f44ace079a4737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605642, "uuid": "624eb5c7-8132-4c6d-9ff8-41dd5b807b53", "comment": "Malware payload", "value": "e0f87697c1d74389261af578bef032c76ea4d5b8db6111505776a2840c39e00f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605642, "uuid": "220d656b-a59f-4e10-a8dc-8532c2527688", "comment": "Malware payload", "value": "d15be3209d2ad8d4f27b533ed5c3bc77bc36f7c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605642, "uuid": "8f8b878b-a527-444a-a000-35b2bd272b52", "comment": "Malware payload", "value": "24381186df236b590c4659c3ee752f1688288f8614bc1d2a892b985b24f9d86e94a03415fc55e2cb53a93e33384ba1b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605642, "uuid": "b42679e3-c071-4da2-b326-bf1bd45e4e7a", "value": "T16E760157FCE228B7D0A9A231892691517A71BC493B3223D73E90B37C2F72BD05A79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605642, "uuid": "d2d97bd9-19b7-4816-8a74-f7b25ff68dbe", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605642, "uuid": "3384f42c-ac76-48dd-bf1b-b4bed1fd69b9", "value": "98304:etNBnZ7hR62iMIp7HF4AT5xwraeqxq4mhJjUdCQ0NkhInnbScgy:e3BbQ2hIpJw+dq4YUdCh6GWcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605642, "uuid": "d7985386-7ebb-428d-a9e4-f5614b377c19", "value": 7637520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605642, "uuid": "044908f7-8014-4024-b866-4c092c386dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605642, "uuid": "ad595d31-5b7c-431e-90af-9dd57cb74352", "value": "e0f87697c1d74389261af578bef032c76ea4d5b8db6111505776a2840c39e00f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ee3582-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "186a6747-f561-4954-836c-76df009ed73a", "comment": "Malware payload (Mirai)", "value": "beaf38dbec83b22ed788c0dc75480789", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "3f9d7ddb-032d-4f73-9ef9-5cdf7d70a5d9", "comment": "Malware payload (Mirai)", "value": "e1169d5bfcef7b883a3dc6f93028c38ceba3c6baf78978cbab16bfd3162019c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "b342f861-ac71-4351-9cd2-1e671f41811e", "comment": "Malware payload (Mirai)", "value": "48ee91631daef8f94c7ea0d68a85a6594577ddf2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623042, "uuid": "b424d698-4dd3-44bc-9320-f6549693a6b7", "comment": "Malware payload (Mirai)", "value": "0167a1af3bcebe46b1889358e74ade21dc3be6e0264ae0562b2e42feb09cf499683ad84ace310591699c1a883faac759", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "d11d5106-e9ab-4c31-b588-910107285746", "value": "T10421CE96A7E35E1BCD940A7BDCEF5B10E321BE44859EF553E36306151C3F21A1F2105A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "74b22dbd-f713-4782-8250-88ac01884085", "value": "24:JKR4llMRgP9qD0at6EoWGkrUlFS5K0VzLCkIdhUgHgQIUSmNfW:JKqTFqDPtdrkFS5KCzLwIUVNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623042, "uuid": "3aa51af1-519a-42fd-bfd3-8c5ff828e45d", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623042, "uuid": "6308b218-8c20-4497-a460-53cbedb94855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623042, "uuid": "8195dc28-84ad-4112-96a7-75d4f6dedb99", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc56c64-699c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781625600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625600, "uuid": "36a110c9-7d87-4d2a-94d2-7651a4fa23d4", "comment": "Malware payload (Mirai)", "value": "ab31123be9bda44f14bc8dec7805a636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625600, "uuid": "8749458b-3214-4cfc-aa3b-b6b709e8be4d", "comment": "Malware payload (Mirai)", "value": "e217a281270dc8762820e5edc7dea14d7cd271c2d2e059719ae917761c7956a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625600, "uuid": "da6a7765-f1aa-4127-91b3-2512d4f2eb7f", "comment": "Malware payload (Mirai)", "value": "e92090e274e9b57b18e4371873b87d6c36775290", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781625600, "uuid": "6eac8b59-131a-4a38-b058-7a24b407964e", "comment": "Malware payload (Mirai)", "value": "09063681d184a79b8cf9aa63113623fb55775d94422f3bbd991f4637b099cdc21d599689a5881eeed40f3c9a3c0965f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625600, "uuid": "4db20a44-7879-40bb-bfee-1bee22f05d79", "value": "T1D9130813B94480FCC499C274173AB63ED93275BE123DB3AA3BE4FB166D46E220D9D944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625600, "uuid": "5f6fe3a0-33e5-463d-b070-cf0bbf59c1a6", "value": "768:g+vDTXZ5VT5Y3jXtk0WgNMa+ouJEyKNjO9X1AS:NTXZ5VTSrtkfgWa+od3jQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781625600, "uuid": "da4995f5-03aa-4024-9077-c4b4d09be042", "value": 43072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781625600, "uuid": "44394464-79be-4218-b37b-5c2676788c22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781625600, "uuid": "4e8d0697-39ec-48cc-81f3-cceaabf9c003", "value": "aba2dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989b4913-6975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781608921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608921, "uuid": "ae761a47-da6e-4d20-9cab-252f771c21b1", "comment": "Malware payload", "value": "45133131734124f5a6d80cbff92408a0", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608921, "uuid": "c4262154-3333-48ef-b13e-9beff0c5c73b", "comment": "Malware payload", "value": "e2267fc0826b87ff9bbad4dc088adac925f992a3b6df06df8713832cafa88dbd", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608921, "uuid": "a7ac6d91-9ae5-4bbb-bad1-c3fbe0da4a13", "comment": "Malware payload", "value": "bc677a15ddec6fa59832e1e998dbb514825a3a04", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608921, "uuid": "079e0393-2b48-44d1-985f-810199abb9b6", "comment": "Malware payload", "value": "799dfa2c6dede83b875420d2b5958a2d4943b3691cb56a06afb6431d3df2687e6f6f8462ea707862b6ac4c21d2080f0c", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608921, "uuid": "b8d645bd-9a68-42ff-b13b-bbc3faf558d7", "value": "T1603165867816C3E27385025BEAFF9E8CB008887A01955992F94E17456369C1F90A490D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608921, "uuid": "67d7d7e5-1f1b-42c9-aeaa-21bda68e3d0d", "value": "24:n/rY2N4hX8KhbeQnQ4duydwMMPbfABYzINo6dhosCHEiUfABzHRAirgfAB/TCnNi:/O8KhbeOduydnobzGdQIAHVgeG7fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608921, "uuid": "a7942816-6ff6-477b-bb4a-42d055e05c9b", "value": 1748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608921, "uuid": "7ad644e5-298d-41ac-b593-2256693654a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608921, "uuid": "db836336-5bb9-4848-acfe-ff462f569a80", "value": "e2267fc0826b87ff9bbad4dc088adac925f992a3b6df06df8713832cafa88dbd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55d294a-6987-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781616781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781616781, "uuid": "a85dbc95-eaac-4eb8-b3e9-e12b973d0bc8", "comment": "Malware payload", "value": "3731c00c3b7e8a05ace4617ff547a307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781616781, "uuid": "eb2273d4-8e76-4a56-bdd5-f6fc21da5e18", "comment": "Malware payload", "value": "e23f2d33c31ffc853b60e943c537cac57482cf80dca5031d549804239a0c828d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781616781, "uuid": "71727890-085c-4332-bfba-2d1f2853d4c6", "comment": "Malware payload", "value": "54a637cc23ff28e41a42938d538b4ef67b1363d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781616781, "uuid": "8e2f6925-a80b-4a16-bf88-445670a7bd52", "comment": "Malware payload", "value": "0732402f86cdcf87098a72155ffceae618b7f0eb7c9c4bd1855cd13a20069a264a45a6da62a06c11076a64dadff820a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781616781, "uuid": "9325cdc4-08aa-44af-a35f-23696425f8db", "value": "T12304D0727ED91448D90EAEEB83AD12FBDB009DE3002146395EDD78690D19B55BC7F823", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781616781, "uuid": "cdda12a1-42eb-4443-bc2c-52f3272ff773", "value": "3072:jhv0ru1jhWk9K1JHm6CUn1tpstFuHZDSP7/Wp2w+3giHKvEem+wjL:jhvnjWAUnYuHoP7/Wp2w+3EM9+wjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781616781, "uuid": "b2758e56-fbcc-4268-b889-4772551c01ba", "value": 189526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781616781, "uuid": "f5d30921-83a0-437b-8787-91ef2067993f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781616781, "uuid": "b2460198-6362-4677-824a-0ed1696c5f0b", "value": "869092.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cbbee1-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781608994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608994, "uuid": "9aca14f0-b2f0-4fe6-bc91-55eabb448865", "comment": "Malware payload (Kimsuky)", "value": "4b2056468b204d242e5ad3f338d54100", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608994, "uuid": "14d13f3f-9155-4151-9533-1c15f25840f0", "comment": "Malware payload (Kimsuky)", "value": "e26ccc2c5e3f20b57b80277e786b65799e333bf0b3f31a80ff36b9addfd950b5", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608994, "uuid": "4ac1c4e3-490d-4044-b1b1-0bdb7bcc95e0", "comment": "Malware payload (Kimsuky)", "value": "2c72408ba201c8ea7342954b89a04dc8c91bfcd1", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608994, "uuid": "2fdb17b4-180b-4a58-8e65-c66a8b89a66d", "comment": "Malware payload (Kimsuky)", "value": "cdb011f688074e329935501014d281867f0a5f024b948ca5cd52e4104a44b12ab97efd4a5ca163776bb4318a3a3c6600", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608994, "uuid": "5107de5b-3033-49ab-827a-f2450be3f70f", "value": "T1BEC2D857765291C77AC853E775DBD8C83F08847C019D03A0B49E8B5C1399AEC92FCBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608994, "uuid": "aad98ed9-a70c-41d2-bbfa-ed210870d9b0", "value": "768:ZKUaJpiuyyWvvnpEDMqZfeDrD30sBRbQs42xNh4GMp7VUhXE5FVGEnIwCL4ukM1n:EMaGD3DdQs4CvMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608994, "uuid": "2a9c4dde-029b-4c9b-95fd-5c4fcf01b065", "value": 25767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608994, "uuid": "18984896-3a5c-41ca-b116-a16517d31aea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608994, "uuid": "da2d14a9-62dd-4284-96ae-ef9e9ade35be", "value": "e26ccc2c5e3f20b57b80277e786b65799e333bf0b3f31a80ff36b9addfd950b5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea65ad01-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609058, "uuid": "dcf93f8e-cdd6-4538-8022-a91671348554", "comment": "Malware payload (Kimsuky)", "value": "ef6bffe8280da0acc160b366579a3ffd", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609058, "uuid": "ea6c7d84-9ff8-496e-9ff3-d9e378f84109", "comment": "Malware payload (Kimsuky)", "value": "e2798eb1978ac9c047c686960342e5da355ecf4c45238313419a2a52d16827d9", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609058, "uuid": "2feb8946-6666-483b-be0f-bce0a1693aed", "comment": "Malware payload (Kimsuky)", "value": "8b2bf8591dc140de040b4563f81c22c15e8edf1f", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609058, "uuid": "b1ad56c1-2474-48ce-92b3-aeb943455321", "comment": "Malware payload (Kimsuky)", "value": "a9554a40071bcb605a13c7ca805d1aa1ed1ccc072968ecadf34701f126c5f949d9bc2e7ae2c307f133013cc66d81a2aa", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609058, "uuid": "e04970b1-06d8-4550-903c-58c9b457b593", "value": "T11803A95B9519C78B7B7022AB2BE7E6C73604CC6900E5CF86F57EC83B63058197264B2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609058, "uuid": "937d7b95-8a81-48da-a55e-7df1a124cc86", "value": "768:xrNvam40KBkohRw2Rx+Jgmx0+oNeszaCt4C19rpdvVNeS8FLNQnahfGkFY0N8:6BXw2Rx+Jgmx0+oNesza4flsFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609058, "uuid": "53de9dcd-b4a0-472a-babe-a1ab549e19ce", "value": 40308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609058, "uuid": "b1987b20-a6f8-42a1-a920-a30d435908f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609058, "uuid": "d2b3d962-b420-4fa8-b25c-b8ed0bd96b82", "value": "e2798eb1978ac9c047c686960342e5da355ecf4c45238313419a2a52d16827d9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30fb34b-692e-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1781578445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578445, "uuid": "81bac7b6-bdf5-4699-a361-eee1aa61be65", "comment": "Malware payload (Joker)", "value": "83f5c57dcf1d238128489a61c6807ece", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578445, "uuid": "2d1d7b16-25a1-4951-87ad-8d874517f7b2", "comment": "Malware payload (Joker)", "value": "e331d5e830c8b8195ddd4192ef3b971312002385d841a1acb015677c0606f6f2", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578445, "uuid": "e4490a4a-d603-4773-8079-5f7b68d2432a", "comment": "Malware payload (Joker)", "value": "75f7ad312b64cc668a01bd44febac368998fab13", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781578445, "uuid": "4b9cda6f-da86-4858-8fa2-5f7a9eab1bb3", "comment": "Malware payload (Joker)", "value": "baa707e1ce746cc409867f8a5b1b23f2fcadfed8de1afdf9308332cc957d527d00c405904e1d928c63f4bdcb97044f1e", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578445, "uuid": "0d632238-da93-46d8-a817-e32b1cc720e8", "value": "T10357120EEB0DA82FDDD3B4BC4D9A425279663C489241C7A76611F12DBEB36D48F19BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578445, "uuid": "b7e45109-bdb4-4fec-a8ba-b52bea880f34", "value": "393216:fHX8BPOkpL5dIwtvIubCVSRU9ZapvCgksxq3zstVTCOtJdY9x8br:fX8BPOyL5T6SeGIgr08J29xmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781578445, "uuid": "646b15e5-6093-4a2a-8332-2913d638e87f", "value": 28162040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781578445, "uuid": "b2fd7fc5-12e8-4d56-bb2f-9a82e9909da5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781578445, "uuid": "d3127fbd-3640-4cef-bab3-3d8539da6f02", "value": "com.puresfix.files.appmanage_2.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470d4e73-6990-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781620381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620381, "uuid": "0982aac2-7eb0-46b1-83de-bf3e56ad6ed9", "comment": "Malware payload (SalatStealer)", "value": "5bf6e385651d48acf554428e8301ef5b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620381, "uuid": "3d7a9fcf-e99b-4c8e-a516-f8bd057a05d2", "comment": "Malware payload (SalatStealer)", "value": "e38a83583a9e712d2163224485ecd934e9b27a6850bbe3c022d6344d0298a188", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620381, "uuid": "30b17893-eb08-4ca2-843b-216c31737a73", "comment": "Malware payload (SalatStealer)", "value": "36fac57421cd3e344ae6f03685df703c83cf592a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781620381, "uuid": "36b8dec6-4346-4fc3-9147-5ec676c8402f", "comment": "Malware payload (SalatStealer)", "value": "874773402ea0108440e93a033bf6b21e8a612c06b49b4a411078da5d9373c50b12c2ecf4311927ecde70a524855630f1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620381, "uuid": "f3e7737d-3141-487e-8ecd-1c02bbc3055c", "value": "T1AF06333670A5B4FCC6A2C078E7A4924DE3213525DF61CB6F03A873916F625C71E2AF16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620381, "uuid": "b8f049db-e708-43a5-8267-0b4a40191ea7", "value": "92a8c05f55aa6ba4be442b82caf5c1bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620381, "uuid": "e2650203-08f8-4e75-a3be-770a2f11c2a2", "value": "49152:UQF8nBwek4VwManH4OzfA89xKFIB3A3eS8MyZO9bMsYeR7gOM5oc3:UTBw5ManH4OzY8Sw29JJR786U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781620381, "uuid": "d929c40f-b28f-4c24-bb39-ba272c24d788", "value": 3845632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781620381, "uuid": "f7215c4a-7781-4d52-969c-bfb91a012708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781620381, "uuid": "b19cfeae-cab5-438e-bdbc-f8a056873a76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e4534e-69d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781649979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649979, "uuid": "581db014-ff34-4847-bec1-93774a39087e", "comment": "Malware payload (Mirai)", "value": "4ead4f2d56b24702334cc17da77c48de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649979, "uuid": "eedce886-6d08-4e45-990a-bc22a60e16de", "comment": "Malware payload (Mirai)", "value": "e5348179d41b0867db083d73624a73b0db0083220028275589a50f1e211d93d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649979, "uuid": "1fc6b879-8c12-4ca1-8e0f-bdc6a8a00271", "comment": "Malware payload (Mirai)", "value": "8065a7179d1a0208ac019444692268983147987b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781649979, "uuid": "86f9eb1f-f0b3-4d7a-8064-98a6a0c1df35", "comment": "Malware payload (Mirai)", "value": "a4ffd21e512a9a4961d5471a9171f822ab25d4c18087df45d51361f634413b726419ca063c18f0eb8f58fe2fb1acd171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649979, "uuid": "04514621-6027-4371-92ab-c9f7ab292922", "value": "T197C3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649979, "uuid": "dfb1e6a1-d34a-4fa5-aae9-b6857d82fa57", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3Q0j:IaOulLUUogcQ9BvMEWSWC2h3Q0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781649979, "uuid": "a3e14100-0ba7-4dc6-a111-27eb0f21e60a", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781649979, "uuid": "17207e60-cfbd-40fd-9646-f7c3ef697689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781649979, "uuid": "b4253df2-1c0b-4daa-ab0d-1ebec48b8cf6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2b1594-697a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1781611157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611157, "uuid": "88b38381-134f-43c6-a62c-f450b151e0fd", "comment": "Malware payload (RustyStealer)", "value": "4b47a73113b5de485833cd436ef95625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611157, "uuid": "ad2c4541-ff61-4adb-96f6-f3ad3fe7ea7d", "comment": "Malware payload (RustyStealer)", "value": "e5c606aebddf2f6f52d66c1667cd1790ca89e7d49ce206422a8d2375c3d7d176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611157, "uuid": "6673b39f-c1f7-46a2-b479-1acfe6639342", "comment": "Malware payload (RustyStealer)", "value": "c04fcd595a584ffce678fd46e31793bc1e8b435b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781611157, "uuid": "2b446c8f-2490-4fae-97e4-d0cd445e70f9", "comment": "Malware payload (RustyStealer)", "value": "070851f514b994d9cb68fb6cecdf7cfa73055fe2973c45fe695dc302643c505b3bb5fbdeebd6170a305bbee66cec6107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611157, "uuid": "675ea5d2-175c-4791-a2a1-3c3b76954895", "value": "T1EDE42A27AB7A84ECD12FC83942275B22BA613C4EC73476BB5E9055253F24BE4AD7C704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611157, "uuid": "f44d059c-339c-4b5a-8e02-d03d7285ea6d", "value": "808c2ac705c088fc83e5d0def2d01056", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611157, "uuid": "e46e6c4e-c66c-43c8-afaf-935d7d10ae43", "value": "6144:smTQG5uhJf7SB/HlSTN7gKQ6JHGm+xftN1bNLOP5VkokW6xjZoKStOpVkk1Sh/Gy:smS7kHwTp5RutQ6Vqkf1S1UGZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781611157, "uuid": "53450529-4c64-4e17-9bae-6dd911ab2b93", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781611157, "uuid": "b79ee1c6-8d7a-4341-9f81-aa968177a096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781611157, "uuid": "7672bef0-560b-4247-831a-74b69931ad54", "value": "4b47a73113b5de485833cd436ef95625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409d703d-69d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781650435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650435, "uuid": "b73d8776-487f-42f4-b913-73584d55df06", "comment": "Malware payload (Mirai)", "value": "2a62c4dda7262efea243ad44cb13310b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650435, "uuid": "878d8183-5d1d-44fc-a546-6f81eaf51a7e", "comment": "Malware payload (Mirai)", "value": "e5ff6cf005916d78830c9f2bc9cf257d9ef813d92e714f7a8ad06b72d18791ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650435, "uuid": "2d465d7d-cea0-4f73-8c8c-5766807d3e53", "comment": "Malware payload (Mirai)", "value": "dc7d97958182d75ae500b35cd06ee03c8035e61e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781650435, "uuid": "66b66d5c-4de3-4767-928c-968b5d11332c", "comment": "Malware payload (Mirai)", "value": "d9de0cb8b934da7603df1d4152aede77fd03ca177c8eda762f51e9812a2909ce18535eb5415d8d1d1957199b95f46812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650435, "uuid": "d8ab3f75-120d-4a57-81d4-327797d23401", "value": "T12E83AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650435, "uuid": "91fb68ce-b031-4e1f-9179-a472ac32a205", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7o:UeAsdukuhoNJVwbmuUqjLjwWio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781650435, "uuid": "3734cac9-bf97-4250-b76a-9631ebbb3c4e", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781650435, "uuid": "dafb4d05-3bfd-4dd9-9078-63b150871714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781650435, "uuid": "f0a1de87-b72d-413d-8f75-729b68ec48f3", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85a2301-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781608545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608545, "uuid": "e35df63c-5795-415b-ab8c-ed81a4058777", "comment": "Malware payload (Mirai)", "value": "4386767da943b94feba6fe2182bda586", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608545, "uuid": "c296c722-6650-477f-b4e2-9d3eb7cffd96", "comment": "Malware payload (Mirai)", "value": "e6a3bb9f54f2ba8d01e5bdbb36972c3e53e7f8fde1a520e86028ad6136e8782c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608545, "uuid": "2292dc1e-68d3-4b37-acee-d449079c302b", "comment": "Malware payload (Mirai)", "value": "2a095455c09b97a61e69dc483654070fa8cf80db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608545, "uuid": "0d2e5ae4-e0a8-40b8-8d77-8f8f53bb0eb1", "comment": "Malware payload (Mirai)", "value": "4be0eafa5f1beedaa596f05b142c401884e9fbe43dced221d080af9847bddd223e1e15bb14b250407d6761fea78fe2d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608545, "uuid": "b5668a70-a2e7-4e6d-8145-bd5fd4eb8f83", "value": "T12074A723C8154995D1614CF322673389AD0B87BF8AE732D3DE2A59A0BF6051F52BEDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608545, "uuid": "95ebeea4-e611-4dde-ae44-8b6ba3bd3797", "value": "3072:Cygja8O5ZaIz88EOBD5Ol3cJKwjoCMYd4aqBIWkrCmIQQAzXETNu:UKaShEO6ccwjoId4aEcCmIQQAzXETNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608545, "uuid": "c505ba8a-3343-4210-8dc4-2646bb527b6e", "value": 369904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608545, "uuid": "e42a43db-b5e3-4b3c-ae12-6dfdfcd26660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608545, "uuid": "bd9509b9-a0fd-47e9-9975-8aec037cb6f0", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e43a78-6997-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623436, "uuid": "e7d1ffd9-7031-4f2e-9f83-00a596338fa7", "comment": "Malware payload (Mirai)", "value": "0da0f35ffc244543c3ce35583f7ce88e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623436, "uuid": "9897cc0d-952e-4489-b5f2-f751d3af4e02", "comment": "Malware payload (Mirai)", "value": "e757b5d4b666dc19a042911da0620e0129b9a127ab92af1a2c6f186179ab3bca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623436, "uuid": "43fa9631-c660-44b1-b42d-65c5526e7c5f", "comment": "Malware payload (Mirai)", "value": "709f4f42d2468cf1e81529bcdb5fdf2ccd395142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623436, "uuid": "ba171409-b534-4e6b-822b-8368a96520a8", "comment": "Malware payload (Mirai)", "value": "b08454964d4d9db9ec711607fafb47ff8e1b843b8a7f019e3133f40d47e492baccd62a963f49b2f7e1cf61b7ba58f2c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623436, "uuid": "8159d238-fd36-4412-84d4-8f19f83ceb2a", "value": "T1E97301E1881E2C80D17C93FCF9B889D3BDDD677CBE9332313501669AD1C3A16986614A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623436, "uuid": "0e80a237-0507-42d5-a2ab-9aa98aa297d5", "value": "1536:gRyfSpaK5UqslS4cpbvdh0eZZiDjQS22cEW+BemSBD/zp:/LqicH+jQ29WcemSBD/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623436, "uuid": "b2e2a3fb-5408-408a-9048-efcb6b07aab2", "value": 79088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623436, "uuid": "71a4e0bc-55e1-40b8-9d9e-bb07a1b54702", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623436, "uuid": "97798221-9aa6-45a5-aed9-51fe0794a0de", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dcc081-69cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781646155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646155, "uuid": "bd845c87-7dcb-4338-a6ab-199f095802b9", "comment": "Malware payload (Mirai)", "value": "815305fe661f5a9db907d39c3041ba57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646155, "uuid": "2c476254-b470-44f7-bb57-f2f56f4ad12c", "comment": "Malware payload (Mirai)", "value": "e842aeea4d861a3ef7b35d7b9a60340f044685570918b2911e7f53e4e798ae57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646155, "uuid": "208be804-3ff4-4a8a-a7d0-df76f139ef32", "comment": "Malware payload (Mirai)", "value": "350d11a5730611c53337b184c997b55bc4981b3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781646155, "uuid": "339b1704-8991-4bda-bbd0-364e55a8ae4b", "comment": "Malware payload (Mirai)", "value": "c246403e07e64114a15a680c18f6b7c4ba6148f0e6d84fa131e1e0fa997fdf5dd8c83c2967560fbff83e8af854061e00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646155, "uuid": "854d5993-fd71-4865-8f3a-36c0982666ec", "value": "T10D83026C617B448BF674B57786FD6382AD360F932136FC15BE97E6894E215382C4B0C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646155, "uuid": "010030c5-b4dd-4ea8-81ad-11dda893db30", "value": "1536:CQ9kiAESAvg40fa5eeaTnXEO1W11aHhphSW7Nc3O3yYkJ0uWGuBIVJus:CQ9mAvg40fa2TUO1W1kBDLNc3YyYC0u/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781646155, "uuid": "371f9a56-010d-4d0b-b476-38dc73cf91d8", "value": 86744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781646155, "uuid": "1d7ec619-dd36-4517-8848-f434c9054102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781646155, "uuid": "5779daae-ae3e-4f3c-9932-13b28e3f1689", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33000f5-6957-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781596054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781596054, "uuid": "26b0c4c3-4597-483c-be7d-b1b472eef5b5", "comment": "Malware payload", "value": "8359bfdb10d52c596890021495ccbae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781596054, "uuid": "b0e9a91c-35c6-436f-a62f-2fc363133e71", "comment": "Malware payload", "value": "e8afbf1004ae40d87fb25005117f692b97e889a4393cc790fbd7a5e8ffea46cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781596054, "uuid": "f9450b31-7a6d-454c-baf5-2b5360804ae2", "comment": "Malware payload", "value": "8d27fdd0cb5bd3d06d01841b4efa71d0764f8d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781596054, "uuid": "c787db0e-745f-4dcd-be9f-51873ae0c7f9", "comment": "Malware payload", "value": "8f4c545a4133caf1197402e079c6a7bf06f094ec565bc7be28c0c3e70bb95f6ba52e2236879972e5c13a621ac115c9fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781596054, "uuid": "445600b1-0cec-4fb6-8b77-e0a00e8aba32", "value": "T127139D48653C895FCD5E0D7DE0A227168BF2A7266C43E3CF5CA490EA185B3D05E4A2DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781596054, "uuid": "8c510089-f354-43ba-aa62-e2a23e9e9e05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781596054, "uuid": "bea1f311-04cb-4625-b044-a78a97568575", "value": "768:Pw+3dyQ4Am+S+IXlCVXBBCzo0/RZLf82AD5fsoJ5ALDyJ:I+3U9+IXE1PAo0/LLf8tlfsoFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781596054, "uuid": "e499606b-e6cd-453a-88ec-42e8e0683cc2", "value": 42848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781596054, "uuid": "c73a7a8b-d17e-4ea9-9ad6-86e1699ff073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781596054, "uuid": "fdcd43c5-95a0-4d91-a267-fd7b47a1d2c4", "value": "LenovoUpdat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1139dca2-69c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781644342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644342, "uuid": "a4ff8729-b1d9-4721-8573-01dac1d96693", "comment": "Malware payload", "value": "2db955d29929a1a545996959bb816ee2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644342, "uuid": "a7d6a9f9-6d26-45ce-9281-b13373fd9263", "comment": "Malware payload", "value": "e9b0ac9d79a62b28cb1b9eaef1eddee76cb252a49c99da4054fe987ed0c2ccab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644342, "uuid": "a5f748f6-7c2b-4408-a11c-0a0327813708", "comment": "Malware payload", "value": "21071e28e4b62bd38e0cd9338042ffd364918ab9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781644342, "uuid": "148f21c1-c1e7-468a-8bac-f142c8df5b67", "comment": "Malware payload", "value": "44954eeea55914068af104a414efb9fec360205a4a3fa31e3544856be3b97fc3432328a43a324748b24f4be41c94e867", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644342, "uuid": "16181b74-d300-4cda-b3c9-d164c59ff54d", "value": "T1AB137D6966857C24AE9988371C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644342, "uuid": "b05b1470-d1a9-4f21-b722-846f8c077c6a", "value": "768:f+T9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:f+0co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781644342, "uuid": "b860daf7-5ea6-413d-a03b-3aadb2d1837b", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781644342, "uuid": "ff8bc678-290d-459c-8484-7bd88f8e8163", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781644342, "uuid": "2fced9c1-11a7-4f0f-8712-f00ece5b96ce", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1df3bb-6953-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781594141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594141, "uuid": "785bf785-9e43-4287-8a18-c1c483d1acb6", "comment": "Malware payload (WannaCry)", "value": "ab236088ec7fad454fad6d3dd7d568ac", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594141, "uuid": "c846df72-610a-4c72-a5a9-67a0d51893fe", "comment": "Malware payload (WannaCry)", "value": "ea4bceecaa998badef365bc44eeebe4a99d1de878ecf8dd56b6e2fe2f663b911", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594141, "uuid": "39df11c0-4c10-41f0-9e00-9031f87d76c8", "comment": "Malware payload (WannaCry)", "value": "c1357f0d778881e082a699a0124ee94b33ea313e", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594141, "uuid": "f27c2fd4-de7b-44a2-bc68-5a4f9ddebf5d", "comment": "Malware payload (WannaCry)", "value": "ea255d0797996f525f14b8bd769dab79e82a5e1502d6d58aaeeb699b87425444b9ea043d01f45631f06e075b19d63adc", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594141, "uuid": "a3ca95dd-0696-4fdc-8a82-6d0e62db6878", "value": "T15C361247A16540BCC009997480FE4F91E9737CA539BDB54E5F42FA1E2EB36C2F692A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594141, "uuid": "23473bd6-c173-4440-ba89-e549347a0992", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594141, "uuid": "5790a602-e629-4ab7-915e-476213c42a92", "value": "49152:jnsnlMSPbcBVQej/1IN4+TSqTdX1HkQo6SAARdhn:DMlPoBhz1a4cSUDk36SAEdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781594141, "uuid": "686e62c9-c1c9-4977-b6d0-10205a4d603c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781594141, "uuid": "a8aa68df-3366-4f64-8810-fb19d055130d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594141, "uuid": "5f4a50e4-8273-4317-99c3-54703165de34", "value": "ea4bceecaa998badef365bc44eeebe4a99d1de878ecf8dd56b6e2fe2f663b911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6573a595-698c-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781618714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618714, "uuid": "70149277-b8cc-4bc5-812a-a7099bce6ee1", "comment": "Malware payload (PureLogsStealer)", "value": "9226d1abadd83a0b5a984339e6bda26d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618714, "uuid": "39643039-7745-4a5e-a431-ac6b0ac1f64a", "comment": "Malware payload (PureLogsStealer)", "value": "ebb8bd5eacabe320fa15c7e69b9da5e7c755f242463cebd7c4713bc677e3123c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618714, "uuid": "f87a3c5c-52cd-4de8-90dc-0871c9c827b1", "comment": "Malware payload (PureLogsStealer)", "value": "bffe5a677b66fa194d3df117641f2a41e3d8cc7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781618714, "uuid": "0ee66a43-0ae5-447d-a95e-59a5b8863d9c", "comment": "Malware payload (PureLogsStealer)", "value": "e002ffd86f2c402398370eda8e8ac2b08c1ba6075f8e04390bc4d0a0efd4c33fb92971ff00319d2f9648c25c604b7f84", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618714, "uuid": "9fa5f27d-bd20-4146-8440-0dcb1c2beead", "value": "T154464C5D0264D7D3E8286A76D91C36C936098DFB98B5FF4132FE4BB95278E213239360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618714, "uuid": "9b81f621-3103-4ce8-846d-bbd491ef19a7", "value": "98304:fyrUdGlqXzY+Z18/evik9BhDzQm5SCNKVE9mAKsoQtAxnaEHGvRIx9Lur/6AKUUq:fsGtj8/evii02MVGwHXxoriAlfjLOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781618714, "uuid": "412e971c-f3a7-4726-8c6d-fce4fb9ea237", "value": 5688913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781618714, "uuid": "9fca43dd-2576-4d63-a6fd-d2fa2148e238", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781618714, "uuid": "03e7491b-4f35-4f41-82de-061b14e8d0c4", "value": "bestangelkindsbreakbackmebestformebetter.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ecfffd-695b-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1781597527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597527, "uuid": "3ee3e039-15f6-49fa-84ea-be67bb3b5765", "comment": "Malware payload (SalatStealer)", "value": "ac3f398f2bb1a25d342fcd9e440bca0a", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597527, "uuid": "52a4f555-fe5a-44e3-b2ae-3d0b87fe99e1", "comment": "Malware payload (SalatStealer)", "value": "ec2ec4474f27e599379a2d65567fab4042cca9d536c3c0a7e2f8f953b47a598e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597527, "uuid": "78159901-9933-4ee4-a67c-d552a2ab4aae", "comment": "Malware payload (SalatStealer)", "value": "13e6a579e19d3898c7c983f09f9e51bef0a6a7ce", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597527, "uuid": "81271785-93fa-4fa6-9938-eabd33f33242", "comment": "Malware payload (SalatStealer)", "value": "39dd5e781be9ed80b142a39e4b75e28d944da634bd719a8e716584955dea03a93814ff470b895f8bc3c89d05712f8a8b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597527, "uuid": "859f1564-b4e0-4835-a64e-8d785639fd56", "value": "T16306334262E1B8EEF06DDBB8C5792645977BF8300F101B4F43D52B662E0A652BC2B771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597527, "uuid": "4da92fb3-3d90-4426-a3f8-ff2a3eb4747e", "value": "92a8c05f55aa6ba4be442b82caf5c1bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597527, "uuid": "030b6635-43c2-4f78-a139-7f89c8557660", "value": "98304:qrRQx3GZn28nYq/uqm+uTbehUMtTMcDPA/7crq:qWBGZn2U32qzuTbzMKcD+cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781597527, "uuid": "27f2ef0d-b15f-46d4-9f69-d4b16f0252b8", "value": 3838464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781597527, "uuid": "fe91ce6c-1dd7-452f-83d4-e9da321aa7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597527, "uuid": "c4a63b05-90e1-4227-bf57-ad15bb5682a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e47e4c-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609022, "uuid": "d306d57d-2550-4b4a-9a99-acb80f0f899f", "comment": "Malware payload (Kimsuky)", "value": "05dabbae6c21bf30247bdc954927aef5", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609022, "uuid": "9548591b-0c97-4a29-9511-961c0f50ca44", "comment": "Malware payload (Kimsuky)", "value": "ec306d90a0c39db09e1c26a82ac54947a79e8a8f6ecc8c9ffe3c2f91be88d4e1", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609022, "uuid": "4334e61e-c386-4368-b5bd-26849870835b", "comment": "Malware payload (Kimsuky)", "value": "88c4ed4cc2b883122842e2a42038ddf5ea8025cf", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609022, "uuid": "29b9d439-f117-46a1-b30e-74c73b09a706", "comment": "Malware payload (Kimsuky)", "value": "be666de066dbe32b2180df942fef9a3f508fa8457084d0d56bf5a583721afdc9ee99de19d5cc51b44e570e22dd436b4b", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609022, "uuid": "c4296a0d-d803-44bd-8a74-d05238463f50", "value": "T17891D797600AD39B2387854BF2CFF988A708C9BC00AA9DA4F0EE5B1D1350F5915F996D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609022, "uuid": "327b425f-00d9-4fb9-9618-afb8b6f3c626", "value": "96:iD5vwxkKnHu74A19Jjh0cnI7bdcvpZzajKq9cD30hpno:iD5psH+FngWuKq9cDkhpno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609022, "uuid": "bd645f2b-2cc4-48d5-9d98-c2a7aa6a4545", "value": 4321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609022, "uuid": "52657fef-8f9a-41af-ac92-4fe30e54b591", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609022, "uuid": "6d2f9773-41d8-484a-838c-4fb7e1ca9cd2", "value": "ec306d90a0c39db09e1c26a82ac54947a79e8a8f6ecc8c9ffe3c2f91be88d4e1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d154928a-6969-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781603862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603862, "uuid": "5d1dd109-b24b-43ce-9a1f-865d6d5e962e", "comment": "Malware payload (ConnectWise)", "value": "9ef660730744dbcad26f40108654ceef", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603862, "uuid": "571e63a7-e1d0-498d-b782-84f90bf077db", "comment": "Malware payload (ConnectWise)", "value": "eca23985908165bcc9684bf5b0b500601cf0f1861dd97192517beb0401e601f2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603862, "uuid": "2ba79bd4-39ce-47e5-af81-3a6bd621a60f", "comment": "Malware payload (ConnectWise)", "value": "b97f98aca0828efd5f37ace123a1478e7d784ce5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603862, "uuid": "b30b685d-4fc9-4566-96ef-6203f2c94aff", "comment": "Malware payload (ConnectWise)", "value": "2e1f1d6523cd670c4e751f73ebde91a3263ee79c4b1a28b5982d382195db96f9c5977742988b703740408b21d8d70d92", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603862, "uuid": "8adacf1d-e539-4124-baf0-1c6276ddb6b0", "value": "T1D7836C43B5D18476E9720E3118B1D9B4593FBE210E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603862, "uuid": "947555f4-0bb6-4309-9199-c1e0d9f052ce", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603862, "uuid": "c6b40654-f1d2-4e27-9d52-737d080f7ea3", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYj70JIhg:genkyfPAwiMq0RqRfbaWZJYYjwIhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603862, "uuid": "5bafc2b2-51ab-458a-bfbe-2863666ab6ad", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603862, "uuid": "8c4a2b24-f7c3-4f55-971f-bde3986640d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603862, "uuid": "e02261b8-4e85-4c1f-9483-011a56a520f2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54417156-6980-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1781613531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613531, "uuid": "36a69d56-7383-4530-b9a0-ef77be927d0d", "comment": "Malware payload (DonutLoader)", "value": "5016695bd91ed548a27f4dea77351f30", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613531, "uuid": "a617922d-93b6-4a8a-bd06-590dea46e2ed", "comment": "Malware payload (DonutLoader)", "value": "f0661c2e8446e0a94c9907f37cb9e2d97feb2a1e9a0182682fe57591293252e4", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613531, "uuid": "4a6605e5-1d4e-4025-ac0d-e735f36605ab", "comment": "Malware payload (DonutLoader)", "value": "3c46dae3ca147ace7b7474544653e3b0e9448a5f", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781613531, "uuid": "80cb684e-6414-4f63-80d8-edf5aef5c271", "comment": "Malware payload (DonutLoader)", "value": "4c2d7716aeb8e3a1a3c12933a8add50d511ef0262927f83073ac73345355c1707fbcbf4dd2a2341110d8081a657c29fa", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613531, "uuid": "7621fb63-cc47-457e-bbb4-8742a137cfc2", "value": "T11A23E831ED9BF85254237181153ED33AAAD65F2E20F18B09B06F1CAB571511D70BB27E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613531, "uuid": "a1fde286-12f3-485d-9eb9-219f889b2e47", "value": "384:j1td1/w1n45f31iU/czrS1T6QMY1J1wJKv1S:j1td1/w1n45f31iq51J1wwv1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781613531, "uuid": "6546aae0-182f-43c5-8a9d-80f250be1b12", "value": 48104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781613531, "uuid": "c152b2e5-1978-4936-b8f8-a2463f552cd3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781613531, "uuid": "c234a4a8-4d01-463b-af76-c615915c9082", "value": "givemebestthingsforbetterplaceigiven.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb400e28-696d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781605543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605543, "uuid": "913df3fb-8189-42bb-b938-ac852d31ac33", "comment": "Malware payload", "value": "0ac4352d7626182436f5ea9bfe60c474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605543, "uuid": "47ac9190-44c2-409b-a3e4-da16362a00d3", "comment": "Malware payload", "value": "f1142436ccdbc52a9c3f00f23d4454886d3b1a1091f0d4b56d69efb31006a8c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605543, "uuid": "5a598cf8-0186-493d-be7b-196902be7e04", "comment": "Malware payload", "value": "f5d4bcf9a29998a9638a2030442dbef2480dd1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781605543, "uuid": "22e30aed-e30e-4f37-bbb6-fe710de5291e", "comment": "Malware payload", "value": "360e6d6dbaf3e19ec2e0d1613885f72930c7be0620aa2c56bb4c3c5a675112cf79c9d3de8212344b2db0758672f21345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605543, "uuid": "9de91a09-7db8-4b79-82b6-91179109d64c", "value": "T1A9860147FCE219B6D0AAA371896291827B61BC493F3163D72A90F3782F73BD059B5740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605543, "uuid": "64f594b1-b040-4d0d-92d0-af5665c1d1b1", "value": "fe9fea8fb19fd7848c8e645e3ea33785", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605543, "uuid": "0450008f-a4a1-4e1a-b050-cc7ff47df152", "value": "196608:/vFT++aQuxnxVQDZdh71Y5fvBNiBVj5Wgaq:/vFaxxQZr71Yh5QBVj5W3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781605543, "uuid": "eb213bc5-4ea8-4553-ac71-675585022c13", "value": 8066752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781605543, "uuid": "126c51b5-4b4c-4e95-8408-1a953feccdf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781605543, "uuid": "2b1c9225-9e20-4d28-b664-568ffbe7f01d", "value": "f1142436ccdbc52a9c3f00f23d4454886d3b1a1091f0d4b56d69efb31006a8c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f4a61f-6932-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781579981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781579981, "uuid": "8a333a9a-699e-4aa4-a2f9-e825718d1c35", "comment": "Malware payload", "value": "029a54af0ce7b9d70a6a6ea8989b81ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781579981, "uuid": "3b8c0cad-4ea1-4141-aece-f6836733b93e", "comment": "Malware payload", "value": "f11f1db40e6d644e44c8a7037e13535fcd9b0b796593e7d1080c76d32195ff5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781579981, "uuid": "47200b94-d423-43d3-8b5d-921308557773", "comment": "Malware payload", "value": "75409bb03a9e6cfdbcefccc7f4872b2665849e97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781579981, "uuid": "acef468f-25c6-48dd-ad01-f9dabd03818c", "comment": "Malware payload", "value": "4164c15f961122ae31a9e5fd29c28508b64b3b09f68d71fc57737d1f91f81eb11cdf5098d97aebfac5499ffb7c93fc55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781579981, "uuid": "6cb33029-0f55-45a4-8d46-223478418c5b", "value": "T10E831229135414E5D62685F1D3FD1B84AE981FA9CEE2EC147C12BC89EE333AD3CD2618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781579981, "uuid": "77737c91-2c06-4930-9a6c-b224bb6303e4", "value": "1536:yYI0ARqw1qAEW67UDWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uBNu:yYI0ARqw1qAEv7UDFM8oJorFquyjkRks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781579981, "uuid": "f958275b-88e9-48bb-aec3-5717d9ef851b", "value": 85232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781579981, "uuid": "07bab2dc-1c16-4246-853e-dee7922aa580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781579981, "uuid": "fd5f6f2b-8373-4c9e-af90-ccc655998942", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706aa404-69d0-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1781647938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781647938, "uuid": "c5469e32-c014-409a-8075-6319b0904d21", "comment": "Malware payload (LummaStealer)", "value": "9394487225859e7dbe1daad782a83183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781647938, "uuid": "b7e3f4a0-d356-4a44-ad2a-4fa5a1ad5b39", "comment": "Malware payload (LummaStealer)", "value": "f13f1e030219e6d913a9970ce27948832e92ee6d00b119217d3c146054a26d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781647938, "uuid": "c7e41430-8a26-4891-bfed-8d3975c5a29e", "comment": "Malware payload (LummaStealer)", "value": "0a948c1931e5371f089f3fffc6a4719e376181d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781647938, "uuid": "1a0618f9-1617-4a48-a4d5-2725b49026b6", "comment": "Malware payload (LummaStealer)", "value": "78656f41a9903f4d31d71336defc1bda3f40afc442346e5a078e225e07e69139b41e24e13466303ac8756b704795f6f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781647938, "uuid": "8ce77f02-3c57-42ac-b642-ddde8bafaf65", "value": "T165B54900FD8744F6E602163144E7A26F7B399D051B369BABEA503A7BFD776E50832309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781647938, "uuid": "cb7b7859-17de-49e5-ab4e-81e5eebc023e", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781647938, "uuid": "5d113efb-e1ae-40f3-ade6-6f50f3065227", "value": "24576:SWwjDBWH6FpSfLg/L1cIA8EgeBCOwynZAu5NHWkBQhORjT/90xZc8ofRGVbhRCBz:SnnB9OPgTHfxr2HEhwmbs/Fx5SuR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781647938, "uuid": "92cfbf5a-8898-40e8-aad4-b454bb5a3324", "value": 2459536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781647938, "uuid": "3002a453-c17f-41fb-939a-416a6a7c1868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781647938, "uuid": "3b22e558-952a-43d2-bd07-80b3ffe7420d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95a9c22-6995-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781622827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622827, "uuid": "836711ea-e661-43aa-9e2e-16750c47de20", "comment": "Malware payload", "value": "cd32e994666e7e1db28368e2800f9696", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622827, "uuid": "9dffd994-382b-4f55-8d8e-80d9a9f3b4ff", "comment": "Malware payload", "value": "f1a6bbb0eadeda17634eac98a5cdaccf15c2779ca9bc414fa4c39cae550f761d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622827, "uuid": "da6f9116-08a0-46f2-bb7f-368ec475cdd5", "comment": "Malware payload", "value": "b4f20c5195340f962a75f552a101aa2eca2b58f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781622827, "uuid": "8acaa63f-ddbb-4535-b0ae-f805551e520f", "comment": "Malware payload", "value": "081f4f9155a6d197faec22aa8dbf29e01d35cff87d701850fc163cba68742d8541288e5d0b0850a59151f2771dacc80d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622827, "uuid": "7898823c-326e-4fae-9b7e-d7aeaf88d28e", "value": "T1C5137D6956857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622827, "uuid": "d2eb9b03-76ec-4f5c-8849-4110728183e2", "value": "768:6z+O9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:6z+bco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781622827, "uuid": "feaf2b02-ee67-4d0e-98ed-eaaf5ca407ca", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781622827, "uuid": "6f3ab8e1-bc63-4046-8176-56bc257c3a0b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781622827, "uuid": "55f85e52-e5fa-4aba-a73c-09bf87ca996f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa754a4-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781606544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606544, "uuid": "3624155f-99cd-486d-83d5-e90b0088fa55", "comment": "Malware payload (Formbook)", "value": "f7217247715350ecb3679e6ae91c77f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606544, "uuid": "4f513a4e-475b-4b34-a2e0-aa8404a14589", "comment": "Malware payload (Formbook)", "value": "f1e1aa06c3793b8e15b15408d32e6df5007d784ddb206f9c4b3075f89e8cb3de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606544, "uuid": "215d7aed-464f-4790-b39e-4ce08fef2f4f", "comment": "Malware payload (Formbook)", "value": "3588153e1f3d52350a00b80558b4bff35781c892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606544, "uuid": "b660cb4d-4181-4839-a285-65672fba8edc", "comment": "Malware payload (Formbook)", "value": "7bada8e2d661f16c2e28ee76b944f18e6c77193e327bd7949b62ed8f2b34c8f7b7076b7b4ceca525b006cb76a4f5d000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606544, "uuid": "565c5984-d14d-46c3-8e32-89217054ca41", "value": "T16D3512682266C607CA7597B906B1F27517BEBEDAB511C30A8FE83EDFB925F104C10253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606544, "uuid": "5e46aa0c-c119-4d9b-8a94-f6456b2a0754", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606544, "uuid": "d25c3581-0409-42d7-9e61-dcc0da509d4a", "value": "24576:X0GzUK8md3tuC40GRaFuyCvLklZC8PjQC0BTay:F5R4BRqrCvLklI8PjQCwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606544, "uuid": "e04bffcf-49a4-4bd0-a8d9-08e8e70c99a7", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606544, "uuid": "216169e7-6b7e-482b-a01c-900b9196abe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606544, "uuid": "8b85edd4-3448-47b7-ac68-1bddabf92860", "value": "VESSEL_INFORMATION_DETAILSpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c892a5-6975-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781609000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609000, "uuid": "9a0720d1-93ba-4e08-b362-c89f37ab9999", "comment": "Malware payload (Kimsuky)", "value": "f4f2f5b829906b659240974fdb524bf0", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609000, "uuid": "cc694f68-83c6-44bb-a101-8112707c2774", "comment": "Malware payload (Kimsuky)", "value": "f2fc49c438faa496d41bf9a5f45321d3795dc7c3b37a85b5bdc8fe2d19a1e596", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609000, "uuid": "518c87f6-d5e5-4eb3-bbd4-7acf22deba7a", "comment": "Malware payload (Kimsuky)", "value": "2ba0495ff60422b59e513e7731c547d36833a0a7", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609000, "uuid": "1205357a-50c9-4825-abdc-2fda3bf40a74", "comment": "Malware payload (Kimsuky)", "value": "612023cd6982f121111db4637b3b680a1d9a822233e64d6e597b7d1a217ff7377e2caf406d40b2c2adcceafa5f7ea494", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609000, "uuid": "f5488801-f22d-4ff1-ab1e-4a7888d6ae64", "value": "T1C8A20AD3B355C3CD77C8C38762EFF88A3F04D036416A4690F8DF4E5E535698862A8A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609000, "uuid": "be252f30-ecb5-4dd5-8a8a-698f0e5ee7ae", "value": "384:8rSapLRmd5pCMc/8WIXyzoZsWcGmSAgwYXnEv6u+RLfAaeEP1MagH5V9Af1OMlxc:CSapLR+5pBc0TyWsWcVQXEv6uCt11Ma4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609000, "uuid": "79a62a87-5d80-4f70-bd04-8701aad9383d", "value": 23121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609000, "uuid": "b2f0bd67-f659-403f-b9b9-77ba15ed341f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609000, "uuid": "fa620913-6de5-4862-9683-f6ce1962bd91", "value": "f2fc49c438faa496d41bf9a5f45321d3795dc7c3b37a85b5bdc8fe2d19a1e596.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb6ac82-6977-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781609893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609893, "uuid": "82ce2c66-c357-4327-9c26-aed1d8b56119", "comment": "Malware payload (RemcosRAT)", "value": "69c66b55c75866b34da0eff0f531b8ff", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609893, "uuid": "4779c4ec-2a33-4b13-be90-8f9bd9efba7a", "comment": "Malware payload (RemcosRAT)", "value": "f3dd97d7a0af73e8189be329ec2f94585032641d0ff5db3b29f78c2a2145089e", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609893, "uuid": "c9bc2a22-fd2d-4b58-8c6a-c180b0ae196d", "comment": "Malware payload (RemcosRAT)", "value": "7766f2a37587a78a4606df32a4f800209f566024", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781609893, "uuid": "10b440cc-a19a-498a-a5d6-46a59c4d7ff7", "comment": "Malware payload (RemcosRAT)", "value": "fd764cc743bd954718eb916a505df21435744155163df968675b58233a5f027fd66e6c19e4d5482bee153fe61bc1142a", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609893, "uuid": "d971d2fd-cb2b-4741-85ce-0ad810c34224", "value": "T18E333A70CA4407A59D8723FCDC847924D129C77A493200D5FED923489A2E5B8FFEEB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609893, "uuid": "31e16d17-6e4e-445d-b649-2562d43ff8e1", "value": "1536:W7K8RLNhxlTYkzgg9h+Une1nogR1nRWkGj:W7zhxlTYkzgg9h+Me1nfBGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781609893, "uuid": "f07f525d-71a7-4e55-928a-4b37233589d4", "value": 51847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781609893, "uuid": "29efba80-1524-4525-88d1-033a7aac91ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781609893, "uuid": "ba449af3-fcd4-408d-a79b-7febea1d3771", "value": "DRAFT_DOCUMENTS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7efa49-6988-11f1-a769-42010a9c0008", "comment": "Malware payload (pedrohaStealer)", "timestamp": 1781617065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617065, "uuid": "33c01d32-43f4-4d82-a9a9-35bd1f957be0", "comment": "Malware payload (pedrohaStealer)", "value": "6cc2ef716ba1fd8af7ee825cd332b158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pedrohaStealer", "colour": "#EF4567", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617065, "uuid": "baece4ec-0b4a-4a8a-aa7e-9e386ffeff7a", "comment": "Malware payload (pedrohaStealer)", "value": "f3e1459d687da13f8455a49ada4ba782c433a08bf17bf268a965038ef39a5317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pedrohaStealer", "colour": "#EF4567", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617065, "uuid": "674c9fc3-0f4c-4d58-8de5-91cc15e27f40", "comment": "Malware payload (pedrohaStealer)", "value": "b37e300e442c4f40c3887c06e674926454d715ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pedrohaStealer", "colour": "#EF4567", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617065, "uuid": "7c2509e1-b1a6-47dc-93c5-c2f6ab75c4f5", "comment": "Malware payload (pedrohaStealer)", "value": "21cbfc803b58e9bc8ff020df35d433eca8ea2fdf24b63d6cc75a6791b700e3a2e745b8bd18cd26263546bc75c93dff92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pedrohaStealer", "colour": "#EF4567", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617065, "uuid": "8191b097-1174-419a-ab0c-7444adb15148", "value": "T1E975F776D7A3CCACC9DB92B07B8787D26538FD690635625B028415127F0BDA02FAE3D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617065, "uuid": "e9c336aa-951a-4113-864f-818fe9c1f420", "value": "d2796318e70a1afc3a4afff5fb20820b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617065, "uuid": "4d8f73c0-d260-4261-a0ab-31fd663c7295", "value": "49152:5P15feeleFt0vIUweN39DpkNgdoA8llDR85j/f:s9N85j/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781617065, "uuid": "bedf374c-2a9d-48f5-a316-62cc8aca2271", "value": 1626118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781617065, "uuid": "d7407feb-ac7a-4817-b08c-582cebf1e07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617065, "uuid": "febd184a-f28a-4416-9c2e-14eb6d20f0be", "value": "f3e1459d687da13f8455a49ada4ba782c433a08bf17bf268a965038ef39a5317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfe8e82-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623048, "uuid": "c693c200-2e9b-434e-affe-00257d340eb9", "comment": "Malware payload (Mirai)", "value": "21671bc2fa1899005de03cdef34249db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623048, "uuid": "9c30ceaa-4160-4056-a7d6-134ec8a7533d", "comment": "Malware payload (Mirai)", "value": "f3fe17e12cce27f5a6863e66eca3011699bfcb2469cf5e6d27809d51186c886d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623048, "uuid": "c6ecdb70-c3fb-471a-821e-6863c8d75fbf", "comment": "Malware payload (Mirai)", "value": "127018b46b69c74f165d41f1ec530e9cc47306c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623048, "uuid": "1ea76bb1-4c5d-4eea-b1ff-f1ed3588958f", "comment": "Malware payload (Mirai)", "value": "d6e06023bcbae5b9b5dc1c585bebf7b5c679a0979acd618fa7cdf657a9d8f98d7099f8cd18fecfe187f1900de64b091b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623048, "uuid": "de466781-526b-4f66-9360-5a2341b9eaa8", "value": "T1D04110191FD01F27DDB6CC36454A2B622ACC841FA16623966274D964BD3F604E7D38AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623048, "uuid": "a2397202-6581-4718-ab64-d407cd5de296", "value": "48:UQ2MNruDSqJ6df9ch+SMTLWPkeTsFCXp:UQnNruupf9cMSoLW7TD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623048, "uuid": "d482f8dd-c614-4d9d-8c0b-6afeba9fc116", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623048, "uuid": "f8c07839-9d45-4217-9f75-3ee8953dc2fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623048, "uuid": "cce40828-b5d6-4a05-af76-0691a6a6f325", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7020b3-6975-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781608929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608929, "uuid": "5fd63f36-70e3-4dd5-a9bc-8350dd0e9327", "comment": "Malware payload", "value": "a84832ad6c00e3616c3595d9690a49cb", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608929, "uuid": "c6a15dae-00e2-47af-9b31-dde6890805aa", "comment": "Malware payload", "value": "f4cfe081c48d4fd9d3629e30885148567a94cc0ddd535b34d4fbc0b88e738d1b", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608929, "uuid": "c5e7a77c-1914-4919-82eb-2176b5648db7", "comment": "Malware payload", "value": "2776ce96232056c9e74d459ee300d2e34dfc1f3d", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608929, "uuid": "810a7a93-8228-4ca9-963c-e8fc28f5a619", "comment": "Malware payload", "value": "d836d1980fc318257277b3aefa3c90e6eacafb4770d6100bc854986fa007e7f97e51c1d6eff0726c47656dfe1abcfe13", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608929, "uuid": "1dba119e-3f37-4425-aa40-9503202ad6f3", "value": "T1DD71D8E7B023C385A3C691C3BBEFE4853754D46901F48E51F8EF1A5D1362F5829A06A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608929, "uuid": "25a24555-9402-4735-ac23-5fe254464164", "value": "96:1C2+g2vk6NC1gX5wwl6MewwmXZW/MuqA7JPaP8NbDZEGI:D5h8C6uzVmulN3Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608929, "uuid": "ba1e327c-eafc-4713-8d39-9ae5c0e9cf18", "value": 3755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608929, "uuid": "f4243168-a69f-441a-a8d3-7bf0a360ecc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608929, "uuid": "a3c9c0d3-29e7-43a9-b5ae-c3a6ab49e0dd", "value": "f4cfe081c48d4fd9d3629e30885148567a94cc0ddd535b34d4fbc0b88e738d1b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920e4735-695b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781597743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597743, "uuid": "91412ae9-2165-4fb3-aeab-3737aa81ddb3", "comment": "Malware payload (WannaCry)", "value": "6770efa141ede4415262c8b1a210b9ee", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597743, "uuid": "989d4ac6-6720-48e9-993b-8b79dcce7f6b", "comment": "Malware payload (WannaCry)", "value": "f622ad48334b0a2a5fe28ac97e52a24c8bf65803ca36afb8f3103db8fbab107f", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597743, "uuid": "42bb58ac-2c4a-4d61-a28d-b42a65c94bf6", "comment": "Malware payload (WannaCry)", "value": "d959eb477280034a31af097d4d592dd1114fde06", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781597743, "uuid": "9357f297-f4b0-4057-bbdc-54309ca22a9f", "comment": "Malware payload (WannaCry)", "value": "1247aed41e0787ce722794a7ca8dd5ef2f7e5a1afc8198523c39d66082ba33d55c1a46f29264644ca6db3a25c26dcb3f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597743, "uuid": "98dd9152-93b8-4b9b-81c0-25288ef1bf9a", "value": "T12E36225531A8C0B4D103513088AB8F22E6B6BC2927B56A4F7F944F7E2F237A1E715B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597743, "uuid": "1a57052e-860f-4f51-be14-6241fb01c1a5", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597743, "uuid": "3a7bdb98-d717-462e-a738-66112fc9885e", "value": "49152:jnsnpEKUv9wC7+VQej/1INRx+TSqTdX1HkQ:DMpyv+Fhz1aRxcSUDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781597743, "uuid": "fdcde287-6abf-4bc0-aba2-89fa9f23068c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781597743, "uuid": "2e27ede2-f44f-4f7b-a2fd-114f8aeb815a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781597743, "uuid": "8a0e3694-2713-45ec-8b94-f81aaa712774", "value": "f622ad48334b0a2a5fe28ac97e52a24c8bf65803ca36afb8f3103db8fbab107f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca2f315-6970-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781606834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606834, "uuid": "17d8b5bf-ab09-407c-99a9-d59351536c1f", "comment": "Malware payload (Kimsuky)", "value": "a17c290e50336f74767e543b431d0a94", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606834, "uuid": "b3944622-ccc6-4f4f-9608-4ae0616d8efe", "comment": "Malware payload (Kimsuky)", "value": "f681e7092d06f5c1399c554a4f4d52b6fcc723d1e0e7380a27906da75e4fc7e6", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606834, "uuid": "c7dac060-feba-491c-9444-4096bc1329c6", "comment": "Malware payload (Kimsuky)", "value": "4e71a97f5527e760579cc06d8b9a15e16dc8c3bb", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606834, "uuid": "85b62f80-5489-422c-807b-cbf5bea62a26", "comment": "Malware payload (Kimsuky)", "value": "c73c6c738db486ef7214e11df09e1a6275ab1890be221f03d2003406a975345ddd01ac5fab4e60c9605793712d9c16cf", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "orange-bizarre-lynx-526-mypinata-cloud", "colour": "#4B7A05", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606834, "uuid": "0c088bd4-edf2-4636-bf89-ccf7820bd072", "value": "T118B37C697CAF6C6F8A34FA7101DAB137E35A0BD62DA448A076C6A3175711D1234E3F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606834, "uuid": "4e0b2589-7540-4925-be20-31ac11a31b6a", "value": "3072:PEZLQHb914sxerPunKJ/MC5Ii5PuulQsQcQNF:MlQneTunKJ/MOIiFuulQsQcQNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606834, "uuid": "a3402298-6c6e-46e5-83f9-8adef3214d80", "value": 108961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606834, "uuid": "62ffe560-3577-4697-90bf-d8a3167f1abb", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606834, "uuid": "bff490eb-bece-40ec-a2b7-529cf8aacd3c", "value": "f681e7092d06f5c1399c554a4f4d52b6fcc723d1e0e7380a27906da75e4fc7e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fe1a44-6988-11f1-a769-42010a9c0008", "comment": "Malware payload (VBVStealer)", "timestamp": 1781617077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617077, "uuid": "ac2f845e-2e67-471e-9770-020c07cb0bbd", "comment": "Malware payload (VBVStealer)", "value": "e228b521325b001cecf46224c8e96562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VBVStealer", "colour": "#8C8302", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617077, "uuid": "18563ba0-4997-41c8-9473-45b0f1491169", "comment": "Malware payload (VBVStealer)", "value": "f993630f802c3958c1ed9f5e8f1f09ab8c568a55c26658172105eabf20d3080b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VBVStealer", "colour": "#8C8302", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617077, "uuid": "6ad7441e-4a98-4958-a168-abb9f02c3897", "comment": "Malware payload (VBVStealer)", "value": "1d2fc128c078e369cc50d038d1301cf17f48a70f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VBVStealer", "colour": "#8C8302", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781617077, "uuid": "de9da534-df15-43b1-8a03-010009c112ca", "comment": "Malware payload (VBVStealer)", "value": "f0009c9fd6a11c1f3e2987fd3f738456b2bcd7475ca4580525ed77123e970fa1b0be2f1211dd2523ca77fa243d23ccaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VBVStealer", "colour": "#8C8302", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617077, "uuid": "f23b16a8-fe5d-412c-8109-d8b16438feae", "value": "T1C2758F47F3B400E8D467C279C9165A07EBB278051764ABDF57908A9A6F23EE11F7E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617077, "uuid": "2b0fd85a-9730-4806-a58e-40d118d362de", "value": "bd627af6c34b01df347f8389537cb0b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617077, "uuid": "1f2d7802-edc1-4576-9300-1e0e5b987523", "value": "24576:uipgtluZ9V0hthoSUyXGJwzmdBRSRISNAfGWcR84lw03:4IZIhbNx7lrR8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781617077, "uuid": "e83d1ffc-84a7-47b9-b79c-c62ba591975c", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781617077, "uuid": "ea4fcbc1-84f9-4870-a95c-afbdd73db41c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781617077, "uuid": "99bc9ccc-e66b-469b-8e9f-78c68dc045bc", "value": "f993630f802c3958c1ed9f5e8f1f09ab8c568a55c26658172105eabf20d3080b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9e4652-6969-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781603616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603616, "uuid": "e5dedf58-82b5-4fb7-b113-a16d5427fb95", "comment": "Malware payload", "value": "b10989adfbee76c1b321ffe848d71c17", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603616, "uuid": "272e61cf-fd8b-472b-9df8-10ce6f70377d", "comment": "Malware payload", "value": "f9b58db28ab7ed018ef8a0090c07570b0c1848d9fc97fcbb9b2f1fde79a07cb5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603616, "uuid": "9e699665-2463-4e6c-9e19-217b9c164225", "comment": "Malware payload", "value": "64f52ea043c6db806ea0038190b3f4f6c2668520", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781603616, "uuid": "82c50c53-38b1-48c3-99ed-10c47cce7dea", "comment": "Malware payload", "value": "113744c44eaa36e269a76c88ef47f011a6f886451f786aab46c0db7d71a1c01b9923e4a89c8ce7b42625db3bfe6b3b08", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603616, "uuid": "6cd057d7-0b54-41f6-8956-50ebf4f34cdb", "value": "T14431CC2027F1535DE6B7CA7EA8BB63205736FC11EA15DB8E0250554D4862610E8B4F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603616, "uuid": "536f7686-4de9-46c8-a280-8dfeee31f71f", "value": "24:8oWmHK0AtwnLK6iWUyAWPW5+/CWso3e1YHr8zFuXQFjOUoMNr4I0W84mQdc:8mWtQZURW4o3X1hBFIZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781603616, "uuid": "aff3bc83-ab26-4453-b327-321eb5c72b39", "value": 1592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781603616, "uuid": "ba87213c-1069-4784-a509-bf5d446e51d3", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781603616, "uuid": "f6ef9ca5-14bb-45ea-aad7-e4de8779b9ab", "value": "video 08.06.2026.mp4.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b0facc-6974-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1781608250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608250, "uuid": "89218049-8413-4753-87a3-1d978b648c07", "comment": "Malware payload (SilentNet)", "value": "dffbddeb5c66afa179027cd3f9ab0de1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608250, "uuid": "1df6504e-fddc-4d3b-adfb-9dea2553d834", "comment": "Malware payload (SilentNet)", "value": "fb1f02a3376bad61155d2236691ebf84c1c0dfa7487e17a34375479bbf066567", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608250, "uuid": "0acb5fb0-18b4-449d-a7af-00ee04b19562", "comment": "Malware payload (SilentNet)", "value": "b2a5d1fde8e99ed512fadaafac42e86d959e8d8f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781608250, "uuid": "dc49aeaf-8d7e-4461-8b70-b5c10c818930", "comment": "Malware payload (SilentNet)", "value": "48356e12a83e36f5677e45d1329749323258cec420e06ebfcfef47db69572b4dc49beefc56070aaba7540d1122d4e81b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608250, "uuid": "e671fbea-e889-437c-a586-acd663935bde", "value": "T17CB533D82D31E505F0A5A3E6046FC9349B57EC40932E5F04F052EBAF9F2226896CB9DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608250, "uuid": "fe67af2f-6659-4c7a-9de3-97c07b0d8280", "value": "49152:gWL8cydKiXeFVYonhse9VDYMfqbnCQGeV8CpJpZHka+:gWLiXXePYyhse9eM2CvSJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781608250, "uuid": "b1967b95-affb-4216-a79c-a4b54c3efe0f", "value": 2449877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781608250, "uuid": "d2063de8-7392-4f24-9b6b-8115865138c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781608250, "uuid": "5be4038f-625b-4504-9633-561fdd6ce85a", "value": "Krypton-UT-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec6f5e6-696f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781606274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606274, "uuid": "c9c70e9c-4512-4a34-8241-d0ab577ad224", "comment": "Malware payload", "value": "77046f3cc9293cbc39fd4f15df48a246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606274, "uuid": "ca07973a-8bcc-4512-93f2-934c651ebdcc", "comment": "Malware payload", "value": "fbccb4dbb65a4347eca431161c250130f815c820ed2ea9bfb9de7e3b5ecf9670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606274, "uuid": "0399293e-cd7a-4df4-965c-b51f8c9621ed", "comment": "Malware payload", "value": "fc66b5d2f46dbb3bc8b29c611166dd56d5bb163e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606274, "uuid": "a0a87538-fa2d-4fd1-8b92-a2270375853b", "comment": "Malware payload", "value": "88b1bca969faf3350bcc8a636b2a4e3bf2a97effc5c92be2ef3fe6704c3d9a321c7131f854acb564de379b25ef4cc760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606274, "uuid": "872c8bd6-9cdb-47a1-82ba-b0e251dbdbd9", "value": "T1B1D38DDA72D812F6D0625235FAE34693EBB338261670478E47C5066A0FFB750EE19336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606274, "uuid": "880990f7-f696-4cc2-8fe5-94d7625f810c", "value": "bd73a7c818a7a13585ac255b70a44a2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606274, "uuid": "9fd09a35-0158-4740-a094-87cb5d38b706", "value": "3072:vxFTU4nyZvqlRCUFCyq59aInZT0PsX3w36xr6nigrun3NdqrKVNO4:vfTbny1Efk9akTfXA3pGfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606274, "uuid": "5031888a-ed5a-4784-9684-bef7e178f79b", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606274, "uuid": "f3ab4653-b5f9-47e9-b982-f2f73ef675e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606274, "uuid": "1dd6bdbe-377e-49a6-8060-5042401b61cc", "value": "mctsetup64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70184a3-694b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781590987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781590987, "uuid": "dc607a95-d24a-4c6f-bc8e-2b13296f1594", "comment": "Malware payload", "value": "5fb9ca3d6f34f0a83ff69ed395605eef", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781590987, "uuid": "0ae98e96-a868-4acf-8e9c-5fe37f5bcda4", "comment": "Malware payload", "value": "fbf9aa57bc628c263d35550701433bd44ecf39b297d2409849f2cbedd6789b29", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781590987, "uuid": "5999d5f6-b11d-4607-9b3b-98dbd7c448cf", "comment": "Malware payload", "value": "09b526a8ca0ca26f0705bf6a173cd85e9902a62d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781590987, "uuid": "2b52fdc2-8715-41bd-8bb4-370489917e0f", "comment": "Malware payload", "value": "d97452f9bc169ac8077a76aa0b078e28a628862e5ea349f858698f2e46db579119fa6e42b84ac19c81ea068bf42bd0aa", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781590987, "uuid": "a72e6362-85ec-4724-8eef-c9c8bfd55c71", "value": "T127331870EF904B92DDC322BDDC943D20962DC65A013344E5FEDD370A950DA78BBB9A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781590987, "uuid": "b8f7bf21-37b9-414e-bccc-0f8da0fc1e20", "value": "768:eXaBcaJxrqBx2me7mYDjrvkgCVNXWVgC75DHgt8pI1cTxS9rd:eXaCB4mgjQX5RI9IUQrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781590987, "uuid": "70342280-3046-4c70-9c42-fe0d069cce14", "value": 51887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781590987, "uuid": "70d0c913-2216-4538-87bd-804bfa3125da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781590987, "uuid": "30253380-3b24-40ac-a5d5-eb75e8c15410", "value": "Request_Inv001_File_details_scanned_pages1_13_headquarters_06152026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e87e85-696f-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1781606499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606499, "uuid": "6311320b-6745-4c62-b588-80fe54a16a84", "comment": "Malware payload (Grandoreiro)", "value": "f8d6f37e15ec3b2b25e2321889523fce", "object_relation": "md5", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606499, "uuid": "298629fa-cef0-4768-a829-388a7e3df99b", "comment": "Malware payload (Grandoreiro)", "value": "fc6a2bfdf91fad1f9c4a0824b5c35bace03afe449932f2b42a8792b92490274b", "object_relation": "sha256", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606499, "uuid": "0b8dad5a-7a6c-4b83-99c0-2515acee1c4c", "comment": "Malware payload (Grandoreiro)", "value": "7962a4ea026f11f3b01a461d5e3a1833713443be", "object_relation": "sha1", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606499, "uuid": "6826f228-2da3-44e7-8a38-ec3ac89ca002", "comment": "Malware payload (Grandoreiro)", "value": "af3e9c61c895793f97d8d781f02c4fd455d2861ab548df5ea419b825a8297c61af22f9ef2d8f2356f2bf009b6f5fb433", "object_relation": "sha3-384", "Tag": [ { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606499, "uuid": "b172ec55-ae22-42bf-a6b9-9407c4ac3ff2", "value": "T11A512A549C3DC41FE09B97B221E7A6CCC818B0192584B2FB94CCD9184DF04BE2B2657E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606499, "uuid": "2f7f2663-4c81-4e34-94db-d1db6a5d3da5", "value": "48:9YEtoOiYokL5zbO8jV3MEI/cgmgUTcChBLyCQ1aevs+7KzuHh1rmAOt:1t/oozi8BKUgmBnLAaf7KHhB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606499, "uuid": "a18ecb7c-5f56-46b1-aa9b-2074f49a7b00", "value": 2749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606499, "uuid": "e5800231-ac0f-4a70-9ea2-9f750cd10dd4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606499, "uuid": "6a4a21be-da36-47a8-ae4b-806d8f681561", "value": "998a2cbd0f0548e0de818fc305963fcad64de1ebcd28e039f43d42af4c4b52c6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d3de79-6996-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781623043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623043, "uuid": "f35e525f-f48a-4d28-9404-decba9f2c32a", "comment": "Malware payload (Mirai)", "value": "713d5c9b03c827991ed4384fc26be65a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623043, "uuid": "44491360-9c54-4e32-9e9b-abd7176529e5", "comment": "Malware payload (Mirai)", "value": "fc9e2e85a8e4bb9a30f620cb274e98db2e9bf5e304c086e95f0417bdff4a82de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623043, "uuid": "a9f52720-a291-49cb-91ab-7fcd53dbdc35", "comment": "Malware payload (Mirai)", "value": "40b8c5b0203c3c68cbc8ceb86cdc0e4ca6e7572d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781623043, "uuid": "405c1a0b-d0ad-4118-9bca-11b18553c51d", "comment": "Malware payload (Mirai)", "value": "6df244afa82072e311d62bbb00d434d20a6ac4486b952096eb03da09862571a989cf551fe43c557240f08168616771a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623043, "uuid": "02b762fb-e127-49f8-a368-b1cb9d55ffef", "value": "T1052102A265DDED31CB3201FBA1856F5717619DD26D1BFF1B8E610812DC392C5C421225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623043, "uuid": "76749357-4ad6-40db-aa2c-51e7b833d945", "value": "24:FlsMHC5ZdW42ZO4l2ZWWlIK3+EjJGk2/4DruQ59fNfS:fspZM4wOewWWX+EjJt2/4fHfN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781623043, "uuid": "030c2049-26af-4fae-bc84-c70d39a54eb3", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781623043, "uuid": "132ab098-aab9-4916-9869-87ea763e1d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781623043, "uuid": "81e6dba4-29a0-4be5-ae1b-3fc5c8670ed0", "value": "dlr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d658f9be-696e-11f1-a769-42010a9c0008", "comment": "Malware payload (Grandoreiro)", "timestamp": 1781606018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606018, "uuid": "7a05e388-73b9-4fe1-9069-9ec86684b6e1", "comment": "Malware payload (Grandoreiro)", "value": "d4cb7d7128133c5ed5f17a1f697b0410", "object_relation": "md5", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606018, "uuid": "59502334-48d6-4bf5-95d4-9a40e86bc788", "comment": "Malware payload (Grandoreiro)", "value": "fee0824bcc6bc86c65ecfb522035e66a86842956eab83153eda141c20709b5f8", "object_relation": "sha256", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606018, "uuid": "03f03fb4-2829-423d-9d4c-3c04fea75708", "comment": "Malware payload (Grandoreiro)", "value": "9b24e54d3c433883f613087820b684cc2950494a", "object_relation": "sha1", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781606018, "uuid": "d43cc603-86a3-4835-a6c7-c58e3ed6f9da", "comment": "Malware payload (Grandoreiro)", "value": "41691f70b16578da52eaf934f170f2d3d4545eb16a3dabb804506f7988c5b593b5d94f616995223deaf648a7771f74b2", "object_relation": "sha3-384", "Tag": [ { "name": "190-102-42-108--65000", "colour": "#918D86", "exportable": true, "hide_tag": false }, { "name": "31-97-173-195", "colour": "#CC3066", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606018, "uuid": "9058c344-5667-4418-9895-5dda3d34a64b", "value": "T10A0205212CE710DDF2774B7527DCF9FB0AA6F4A5682D71B42041C6444BB0AD4DCA2EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606018, "uuid": "a08ce71a-167b-48c5-992a-5b1c8c1e43b1", "value": "192:8p8eI1L2cMacvlkLFP6cDc/X/Jc1/CO7jN0/OVlccMvMhqecrYk0:XeIJ2cMacv6LFP6cDcPxc0ojN02VlccR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781606018, "uuid": "daac6eea-fa75-4d1f-8336-5e6b7dc07191", "value": 8497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781606018, "uuid": "1cb74d2a-7ccd-42dd-9aeb-927c6174c51e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781606018, "uuid": "8395a125-b4f5-457e-aa6c-c66bb2a7e7aa", "value": "fee0824bcc6bc86c65ecfb522035e66a86842956eab83153eda141c20709b5f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643f5e3f-6954-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781594660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594660, "uuid": "e8f365da-3421-498d-be8b-56016bde1205", "comment": "Malware payload (Mirai)", "value": "a278c24b0737fdaa742f3fab3eb7586b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594660, "uuid": "a59a68fc-b3b7-424e-8d85-5e7d8017a4b1", "comment": "Malware payload (Mirai)", "value": "ff25e9273b712a91dcffab49c09aa189a9d148f50455d77467dfce6710625156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594660, "uuid": "604e7743-778a-4deb-bb54-3ddc9864148e", "comment": "Malware payload (Mirai)", "value": "e075dd26937de32fcdc8d96c51d149d09d098f4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781594660, "uuid": "e2d7afb8-7a48-4c8a-94c5-72dce8d3e08a", "comment": "Malware payload (Mirai)", "value": "8340fb75a6368ced5fc268ee5335742dc5171ee3465f60586385b1027a4cb1bdaaa8550f09a0d70b157a2fedfe57e913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594660, "uuid": "7db6d4fe-7954-4dbd-970b-6a3a72d332f2", "value": "T17BB67C88E783E8F1F24348F0139AD7A7242016296057F5F2EB896F66B4773816F19379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594660, "uuid": "9ab7e1a9-4fb9-498a-88cf-f01bea1de1b0", "value": "196608:KpOsC0NEVOKXk9zkd+4lk0md+Uexf0JHChFV3+n8DCLmPJmvcNpn8ccMsK4gC:KpO7k9zygHkFV3+n8DCiPJacN6ysK4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781594660, "uuid": "5e77e9ef-a9df-4f6c-8031-dd46305d5e85", "value": 10696088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781594660, "uuid": "ce47e770-d66b-406f-ab7b-c5beed853ec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781594660, "uuid": "8d292d69-6111-4f91-9f10-d952df389534", "value": "xmrig-i686-static", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e45a945-6993-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781621628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621628, "uuid": "885ca635-6f01-4789-acec-e249dae78bb1", "comment": "Malware payload (Mirai)", "value": "3fe175e630aef9428607d7851fbe9cc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621628, "uuid": "03af056f-04ee-4aa4-bbde-95d8ab9219f6", "comment": "Malware payload (Mirai)", "value": "ff2d17e90cfd9131422836dcee11ff2f4b3b73586a0d267930488b8b5ff1c594", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621628, "uuid": "4139d4c4-a714-4740-b5b7-d05923e51254", "comment": "Malware payload (Mirai)", "value": "389c6de3087c9aff9c3605abe39ed7c126443828", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781621628, "uuid": "21cf1e7b-7518-45d9-87c5-a3a344a570c6", "comment": "Malware payload (Mirai)", "value": "a9de3203dc0f8584f6acb179175308ff78f43358f90e4c798abbfedbd624d1c93c96c69a0f588435718fce5e037e6efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621628, "uuid": "44e34b7d-1321-4525-a643-e417eb80f91c", "value": "T10023F1B0B2B5DFA1E0B02B3A9771CF0E681749B780D532217114315CE79AC95ADAF8F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621628, "uuid": "f6c36d6a-9e7b-45fd-8efa-707085ef63b9", "value": "768:/dMR5WP17MvkZSE+X45GeAr0Mkoxwx4FF/3hfyvxIWVwLps3UozD:/dMKP19ZSE+5rSN4FFZcxIH0zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781621628, "uuid": "9dd46ee8-f18f-488e-a617-c2a938469647", "value": 45628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781621628, "uuid": "72fc34ff-2a73-4a61-a6ef-75f2e034178d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781621628, "uuid": "f3f84caa-ebd8-40ae-ba97-8aa198e1b85a", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4668ab58-6972-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1781607495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607495, "uuid": "06930e04-1ebd-48f0-b8b9-35c7887b405d", "comment": "Malware payload (Kimsuky)", "value": "12daeb46f6b0a047575929051130116c", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607495, "uuid": "954aad9e-8e85-4e7a-9e8f-4d882ae8a868", "comment": "Malware payload (Kimsuky)", "value": "ff6c6bd999d8b08fe87475c5e7526dfa1ab869eadbfc99c6f4df05c7da2970dd", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607495, "uuid": "a34f7ac2-9053-4279-b8ee-be6d47e55b21", "comment": "Malware payload (Kimsuky)", "value": "39b60d78e0dd8193ff8f11bd1fdf1ae468e5a9c9", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781607495, "uuid": "3d0eb96d-fca3-4f9d-a2ee-db491aea2d59", "comment": "Malware payload (Kimsuky)", "value": "2edb1ed9de9276ce8ffa2901ba80809fb3b59d3224733e34944d66538cb02529eb313642206191f3119bc444df3791f4", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uni-site-je--mort-php", "colour": "#606429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607495, "uuid": "746a732d-7125-4b0a-9bd0-d4e126e115ba", "value": "T1F9A2FAD3B221D7CA72C693876297E8CD3B04C179019B96E1FCDF4B4D235AE8850B4A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607495, "uuid": "27f125ad-cc80-49e9-898f-7b5380f315e8", "value": "384:kEvUeyF/8LFSfqUsMDsKyuOX7AyW44CmEH5jl8miJUpY69ibKL6krIR+6YqrN+73:kEvUeyF/8LFSCUsMDsKbK8yKCmEH5jlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781607495, "uuid": "c87695f2-2137-4981-bba9-50181a030c67", "value": 23177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781607495, "uuid": "fa5b34c9-9663-4c5b-99e1-40c4d2f889fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781607495, "uuid": "adf6fc89-9e4c-4afd-82a8-b0cb7a91e1d1", "value": "4wzn3jjx.w2p.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }