{ "Event": { "published": true, "date": "2026-03-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-18", "timestamp": 1773878582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "37c6b17f-c37a-47e3-93b9-115b981584e7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc60a172-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773828272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828272, "uuid": "b108a0dc-28a9-4114-950b-346546a346d2", "comment": "Malware payload (RemcosRAT)", "value": "7c2c0a32666af8c5804c21c7c6ff32c6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828272, "uuid": "488bcc65-1d46-43ea-b932-d87453adc52e", "comment": "Malware payload (RemcosRAT)", "value": "0119975b2b3d043ba32b6ca3b735b5e7defd0aa0bbcd5a43dad28d1e3003de9e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828272, "uuid": "8fe4bd96-ec96-4616-bd80-43446f9163b1", "comment": "Malware payload (RemcosRAT)", "value": "829007cb53c930dbacc6d0043ce965d13b157146", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828272, "uuid": "f9e5604e-f33a-4518-9d71-c82dfca7493e", "comment": "Malware payload (RemcosRAT)", "value": "81fd8e5ed83eda23db85124a93d6f41d6c85559966e0dc60d6b579831f5ba62fcad51aeb46eb5a3d2d319613af1496e6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828272, "uuid": "ad1ee650-7e6a-4e42-9a1e-b51a1a925271", "value": "T1F9E5E38FCC199FF7168C37D29C9204DE8439C971B6DA1830AE723AC46D7A76915C92CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828272, "uuid": "8550cccb-0420-431c-a7a6-aaf19f3d55e3", "value": "192:Yiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiir:/FqkjqcwewrPZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828272, "uuid": "bf8c4d5d-b6ed-4915-9444-ee759b0ed5ac", "value": 3041596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828272, "uuid": "1098b9c3-6a01-46f4-9400-ad5929612677", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828272, "uuid": "4ee1b0bd-b578-4f8d-b884-9e4a2c822148", "value": "seethebestpartfromegood.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5041a13-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773825200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825200, "uuid": "0b24e5bc-378c-400e-a0b9-380b9aa8aef8", "comment": "Malware payload", "value": "a0b18080225bd5317f003f658c43f50a", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825200, "uuid": "6bf6bc9b-e575-4e1c-b45c-619dc96d500a", "comment": "Malware payload", "value": "02407fae5daf37da1b1ce4c5d2ab8cfd7a458f44967c5864c895f1483023b5b0", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825200, "uuid": "77a9da19-d78f-4f2e-bfc6-9ba24a583168", "comment": "Malware payload", "value": "6ada53e81e4a8d4bb5602c816a21d25a1f4f7e9a", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825200, "uuid": "15804bd0-cae7-4b74-b3ae-935a330d1d05", "comment": "Malware payload", "value": "40fdde7c21769c692388a526af58cab191425421e4ebb75837e3db162bd38fc0c71450e01e3b43f4ccd0f1e39b5ce986", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825200, "uuid": "c5b89155-2803-4b94-83cb-3a19506c538c", "value": "T102F4121664541D77C2AE1F34618489521C2EFC52BE48E887C2CC77FE1F386FAA197A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825200, "uuid": "d169fd7b-8508-4418-a97d-09b6f945f666", "value": "12288:WKzv00rc13vRDTFKzv00rc13vRDTS+vQ+aWz07RUthmK6RFoZ:jVU3vFMVU3vFS+va2cUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825200, "uuid": "b1cb5ff4-8d8e-4f55-8254-99b872061429", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825200, "uuid": "864972ca-4269-4eea-88ef-938353cbcf74", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825200, "uuid": "410ae8d3-c612-4d96-af51-1a8205a277bd", "value": "a0b18080225bd5317f003f658c43f50a.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e225055-2292-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773814853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814853, "uuid": "2f687e1e-669f-4b14-8154-71d2af005ccf", "comment": "Malware payload", "value": "3d71c7b238a1c59723e89507a01690a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mann-Technologies-LLC", "colour": "#E9C3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814853, "uuid": "2c0bf124-c985-42b9-83ee-7086d2e5d375", "comment": "Malware payload", "value": "031c37911ff8933c904fca037f7511d9092f4f20360baf0bebea6c1c63c21d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mann-Technologies-LLC", "colour": "#E9C3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814853, "uuid": "6a6f7be7-2888-4032-9b9f-6193ee8b3a3d", "comment": "Malware payload", "value": "c924344bae3a1dfabc9e8f1550408959cd18f6fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mann-Technologies-LLC", "colour": "#E9C3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814853, "uuid": "2d0e1a86-850e-4b65-b766-2688a4c20957", "comment": "Malware payload", "value": "9260d8bd3bc1c0834fc9b9c9175ffdecc4aa081c243e4c853c1f6b63c38f1a39bb6bb8f4c0471790f6becd250b3c162f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mann-Technologies-LLC", "colour": "#E9C3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814853, "uuid": "a6728b7e-4fc1-49c6-b8c1-0fa7a1fd1987", "value": "T1B7673367F176552AE02BD63E647AE8012C3B6E5A912D4C065EECFC5CCB37072183EE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814853, "uuid": "6e65466e-7a65-4bf4-975e-5365f0e48eb0", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814853, "uuid": "3afcad2f-058f-4af1-8b9b-c376d3047981", "value": "786432:pZLWSRYaqUpM7HLx+gNXMcq0YHGNgnzAGNJwPk62fV:npTqEM7HLIncq0Y0gnzfak6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773814853, "uuid": "eab8e056-8964-433f-a864-580187827765", "value": 30663080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773814853, "uuid": "a0494a26-a1dd-445d-b0cc-35b0d1afd480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814853, "uuid": "068ac80d-0f79-4902-9b3d-b5c2cfa2736d", "value": "031c37911ff8933c904fca037f7511d9092f4f20360baf0bebea6c1c63c21d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b039d9f-22ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773853261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853261, "uuid": "88bd4e4f-a4fc-470e-ab84-6a5b2e611016", "comment": "Malware payload", "value": "21e22c25e4bf13f372de8c8ec0ca9632", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853261, "uuid": "825a4ad4-60aa-4fbd-9e12-ae1eb2a25c91", "comment": "Malware payload", "value": "0346c9d56c2539ad5d4997770903845a2d3d1ee24e0032035eb3856644cf9a2b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853261, "uuid": "99140f3f-191a-4d06-9e71-cb0a709757c8", "comment": "Malware payload", "value": "82be617a65a02feececd0e84c7120b3846da8af1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853261, "uuid": "29a4737a-dd65-4c1e-bb63-0c304b2750da", "comment": "Malware payload", "value": "d6d9ffc6d7423b5e1afcc7d407f3a6f34ef31ce3a5346a2f2d6b811d9ab3ab514e8aa8435f01b0d40788095082e5b853", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853261, "uuid": "c0c44741-3702-4a40-875c-eca1766d2f24", "value": "T1EF6533CA7A70A84BD264727E8D3413D0E3D2D906F52AFCD80B1EF9E4ED910C1B69694C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853261, "uuid": "8724d92a-5e0f-439c-b313-ea26e3d17176", "value": "24576:5rLtOhe7k8jN0b0oiJpwk9zKzNBKo5fA58vIOr/WC+IF5Z/Jl9gI9sUBdMZ8RVQ:5rL0Q77C4oopw8KJUopA58vIoX5fOVUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773853261, "uuid": "a2ee067a-821e-4de6-b316-366908c5490f", "value": 1518244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773853261, "uuid": "f1800b22-02e2-4476-87d7-707c54d1a95d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853261, "uuid": "83fdb324-be26-40d7-ab34-62a15f2cd566", "value": "18.03.2026 F\u0130YAT TEKL\u0130F\u0130 BEKLENEN \u00dcR\u00dcNLER\u0130M\u0130Z\u0130N L\u0130STES\u0130.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe9a78e-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827258, "uuid": "6bd4f85e-ae86-4f38-8dcd-95b7aa18a14c", "comment": "Malware payload", "value": "df40b64f3d91f467fd52e425a9306182", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827258, "uuid": "abe4d8c5-c4d9-48f8-9cea-30e74ec2b80c", "comment": "Malware payload", "value": "03a3e2728276ee6b5e763e2ece769963f6bc4b5382eff86621fdde75ef294681", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827258, "uuid": "fe3fda90-4550-4d70-8b52-aedcd50b8463", "comment": "Malware payload", "value": "5fd5082a9e72bc446e314c5b54284cf3b3c1759e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827258, "uuid": "514d5f1b-c2c2-4b33-a0f9-6cb19445b4cd", "comment": "Malware payload", "value": "2cdefd76de751f193297b0608314a78e6c15283bc68608b03a886f5d0d463ca56de7fd362754444f6ac866835189ede3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827258, "uuid": "cf2979d4-fd77-459c-9191-813c148a87da", "value": "T1F7957D192A59F6E4BBE88B1F18ECE98F6F7491977114E859F693E4093CF76048B0C02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827258, "uuid": "2ebe8aed-ce09-476a-864c-abac6c7d7e9e", "value": "12288:p96YxTfRm0KKYxx12CPKA8UmM8Jv/I4h5EtiZj/y1B+XcBcvFssn4V9WOeANyQSQ:pMYVg0kCH/J3Hrd/ho9SBHkOVn0u6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827258, "uuid": "cc487374-9553-4985-bdcb-05d2bd6568aa", "value": 2014095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827258, "uuid": "7e96b5eb-2a99-4335-8b18-8ab298efd16d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827258, "uuid": "c74a8490-a488-4100-9684-7137434358dc", "value": "df40b64f3d91f467fd52e425a9306182.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8a04d4-22a5-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1773822848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822848, "uuid": "1a832adc-ac2a-4b4a-a3c8-a22da212d397", "comment": "Malware payload (CryptOne)", "value": "9cee958019bf1648402c7b888a80a079", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822848, "uuid": "46269998-1218-4f07-bfed-80ff97c44141", "comment": "Malware payload (CryptOne)", "value": "03f2c03bc8e7bc751206acf7f1fc90b0515aa038fca880bc8d0fb8e10456eb8f", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822848, "uuid": "73f30a4d-a2f7-4fca-9366-d01ac5d8f85a", "comment": "Malware payload (CryptOne)", "value": "5dec2a15069a8f3a8a86efaf16485ddb6747885f", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822848, "uuid": "10584e33-dc77-465a-aaa2-023bd2d61bef", "comment": "Malware payload (CryptOne)", "value": "59be6bfdd5f1b8dbf70f203854ea205156ab1f8a4b2b37fe3cd76af362809bed775fa46744fb1d3f12e9cf97406e4921", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822848, "uuid": "8312a63c-6326-4f44-a234-bf7c2f02957d", "value": "T1E066E0A2BD860577F1318A786E73F546B468FB332D68CF5536EC4AC95B39281B920307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822848, "uuid": "768fab07-9e15-4ecd-800d-81a20413970f", "value": "bf8d88fb7815175dd959fe045f668096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822848, "uuid": "7f971d47-378e-43ff-8cc6-3ded24c8d753", "value": "98304:ti86KF0hFldeSrmEgpc+pppdRfV1uOcljejkQD6O:tiKF0xsOmEAc2RNv8jejFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773822848, "uuid": "f799012f-d4a9-41c2-b18c-1b7a7d761108", "value": 7082496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773822848, "uuid": "934b72f9-4954-4892-9cb4-fc283d542ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822848, "uuid": "82be6f84-b16d-4202-bdd2-684e02925d55", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f495c9-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773827050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827050, "uuid": "212f69a6-136f-41f6-a7d0-ee26a3850a0d", "comment": "Malware payload (MassLogger)", "value": "f8433b7ab4c281d17377c11f2186f18a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827050, "uuid": "a6298b49-9faa-485e-b05d-bbd184b591ed", "comment": "Malware payload (MassLogger)", "value": "044b196f8e02011e2768daeed9d5a69e6e9de46a46121ad75ed76cfa5de18fbe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827050, "uuid": "7903d0f8-1048-4629-8d81-c486fb727392", "comment": "Malware payload (MassLogger)", "value": "9091633fbd7cc5cf36cd2000b9482b50f0b98765", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827050, "uuid": "75517184-7e16-4b02-ad32-dbbd5f6528c9", "comment": "Malware payload (MassLogger)", "value": "a3718d1259b6232f6820466ae3273eb4f2df0bcf19b3ec2f4a1cf384d8c265946bc433ff6146f53172246b37343bc941", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827050, "uuid": "785aec61-4624-4720-b65b-ab6a8665e8a9", "value": "T1D0759E855243BFCECD9C030D10FC679693E442E921A6AE7BD5A6E8D805FA941F0EF49C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827050, "uuid": "436bea7e-7d12-4400-92a4-2cd397beffbf", "value": "24576:O+hwLGH5Bv++3lEgXGqCOzgx3UuqftvImUO:hHG+3lEGGqR8FUfNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827050, "uuid": "31a87382-d9b1-42df-8a3a-9ee8cdda4b76", "value": 1586421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827050, "uuid": "3cf3af7d-4dc4-400d-a201-7dc9dbe7312b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827050, "uuid": "402ee62f-a76c-49e6-98c4-325cbd054625", "value": "f8433b7ab4c281d17377c11f2186f18a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502a3c52-22e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773849082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849082, "uuid": "f349e52d-a655-498d-9b74-d35dc2742740", "comment": "Malware payload", "value": "314d073aee67fede1cb5dd099200a9d9", "object_relation": "md5", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849082, "uuid": "5852e0cd-8979-4d6a-9fb8-278c4007ad8f", "comment": "Malware payload", "value": "049759433336d9744dfccb95c2129377cc291006c403a4dbded3506f38d8ea24", "object_relation": "sha256", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849082, "uuid": "38a10fb7-c121-4194-aae8-fe2685e28ff9", "comment": "Malware payload", "value": "c43721238f500a9b458247d983e819d3f4928f6c", "object_relation": "sha1", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849082, "uuid": "487b4469-93a9-408b-a857-57dd31ec3dce", "comment": "Malware payload", "value": "7b6f18a976f6c5ca4f3bd98a7ee6b0a880dd8b9e2ddf0b2cf611125da860e5c7b9ed52a06adcb9b27416d749e646192f", "object_relation": "sha3-384", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849082, "uuid": "a6a73d76-1122-4d2a-a312-38f4a0cd08df", "value": "T1FA36128006922B3E062D713D351A5F2FCFF2E95D108C72AD6B80B981AAD7B19573DE74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849082, "uuid": "22e9695d-6490-49fe-9748-fbec36f9e3b4", "value": "49152:205L5CoIx4/m7nxBqr6IWROMAbhXZzpM9VN91RlAEsaAycxcyNuzjbbrgb:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773849082, "uuid": "f507a3a0-b5b5-4659-b884-e38c2dd1f483", "value": 5154508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773849082, "uuid": "208a7ee0-5138-4250-bb8b-4012b00d7824", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849082, "uuid": "99d78a1e-82e2-4522-8c7c-43e82f8a9e25", "value": "049759433336d9744dfccb95c2129377cc291006c403a4dbded3506f38d8ea24.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5dcdec-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827229, "uuid": "93dbf55e-afec-472d-9432-cb693d7180ee", "comment": "Malware payload (Formbook)", "value": "ccdb198acfc88d4d5df9659d44b49397", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827229, "uuid": "c67249e7-5beb-4463-9bd0-2003ef9ff5c4", "comment": "Malware payload (Formbook)", "value": "072390f5cd7fcc48e7f9c622adadbb70e58ec12ec3740897ce267e075a27033e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827229, "uuid": "33369386-e087-41a8-a893-30c743d29175", "comment": "Malware payload (Formbook)", "value": "3063153a274fe91f0a10e6c13d5d92dae2930fae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827229, "uuid": "43556c3a-a8a3-46f6-976b-63745d5ee888", "comment": "Malware payload (Formbook)", "value": "101e3278aa5b9cc8161a645f2fe5b79c72e9c99184a04a8a5f93d0c9c3b9d9b3f0c77a2507c11742e6c163c24b1f3678", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827229, "uuid": "8962c32a-413c-4dbb-851f-01e920786f26", "value": "T10145D893361730D84CAA17E78AB1FF21ED475207BB973A6B97D834EB82BD5D94243024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827229, "uuid": "e6e2aaf0-3fb2-44c1-9959-0578f5d680f4", "value": "192:iQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQw:wPHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827229, "uuid": "a13e0729-7ed6-4cfb-b261-15492c812b3f", "value": 1204358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827229, "uuid": "05f0a939-3806-4444-b866-588dbab3b1ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827229, "uuid": "9163cbd5-4bd6-4c4a-8b71-d16d3ab7d07e", "value": "Request-for-Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a410f598-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826460, "uuid": "a147b03c-38a1-43e6-928d-76f2c6401b18", "comment": "Malware payload", "value": "1eb2014bc68aaacced571ad59480f6a2", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826460, "uuid": "7d03c0a9-4650-441d-b4b9-2d0d8aeb46f4", "comment": "Malware payload", "value": "07281faa49184993c9fd4323891b166581ca4d2fe7ab70fb66d1770b0382a35a", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826460, "uuid": "c295da28-a7ee-49b7-826b-355bb3e7cdaa", "comment": "Malware payload", "value": "3cdd8667619aab34dbfecece2ae13b928ee71570", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826460, "uuid": "4673aa44-8fa0-423b-adf3-36fadba4dc79", "comment": "Malware payload", "value": "1f500a7b9082611e94128d963cdc3b53cf8c131425972e41e6099e29165d592e779ff531b2556bdba2377f1fcf69d22c", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826460, "uuid": "11f444a3-5890-4b08-a881-ba5457a8174f", "value": "T181530EDB756306A43E42BE3949C58C8C8BA9CEC2D5CB893719ADC5CD8017D8A24F7D2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826460, "uuid": "331314d9-c025-4f8a-973f-354ccf7eec13", "value": "768:LjptlCpqMrkMeRxph3pDpiAuzphpoph2pr:fPlCgvTFbuzb2X2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826460, "uuid": "2e6bba60-ddd6-48a0-b918-faf3216b4322", "value": 62365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826460, "uuid": "72defa64-5d9b-46ea-b852-05176847f689", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826460, "uuid": "acbc64ad-e6e5-4e4c-a317-4e5aeca0d1ef", "value": "1eb2014bc68aaacced571ad59480f6a2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3729b5-22c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773838018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838018, "uuid": "22a0cf0b-1bf4-4cad-99b2-795cbb7363bf", "comment": "Malware payload", "value": "4b740138d925f76ce6453e6a3e828c3c", "object_relation": "md5", "Tag": [ { "name": "46-30-188-99", "colour": "#15B53F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838018, "uuid": "baaeb28f-57a6-42a0-9d46-4a0f92662869", "comment": "Malware payload", "value": "080e5ded51c69bcb1a173bbf035a4ed48d259e2f0343115f8e0bcd8a932d57eb", "object_relation": "sha256", "Tag": [ { "name": "46-30-188-99", "colour": "#15B53F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838018, "uuid": "d9fc7e17-a703-438e-9505-4ce36a85c6bb", "comment": "Malware payload", "value": "b976fbf790fa9b29aba081be29c89392b7f2a155", "object_relation": "sha1", "Tag": [ { "name": "46-30-188-99", "colour": "#15B53F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838018, "uuid": "491fa33a-afcf-4373-888b-36de19540915", "comment": "Malware payload", "value": "a40c33880ea274a9b4b64910d8a957b6079f2dbc688181bf393e569e66aba1c79c804208e30302f119eee64e1a8aaa8f", "object_relation": "sha3-384", "Tag": [ { "name": "46-30-188-99", "colour": "#15B53F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838018, "uuid": "1c093928-dee0-4622-b79d-f401421b9f5f", "value": "T1DC148D56B3A504BBE9B7C639CD630646E772780207609BDF03A042767F277D05E3AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838018, "uuid": "3ff6dc2e-e011-4169-8edd-9c7c9780db4b", "value": "c556f65b0320cbea87f199fb45a6de9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838018, "uuid": "fe5373df-6db3-4c06-a423-d5bb044cc7e0", "value": "3072:1PiLnXpwGEhFb7ihrSer2pz655YaLv0Ved7/lpCwX07:0LXOBzbmdrYz62edbPX07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773838018, "uuid": "ce48c66a-3b37-4640-8aee-9aa6b01959ac", "value": 194712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773838018, "uuid": "6a24f202-534b-4168-ae65-f99a2f8386f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838018, "uuid": "496d8758-624c-42e8-a492-8c1e6e5d0112", "value": "cloud.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77e5dbf-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827002, "uuid": "dfec0220-bf10-4123-a8a4-5c8d93802868", "comment": "Malware payload (PhantomStealer)", "value": "20baf6a2e59647acfafeaca5f4fbe72a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827002, "uuid": "ce916e7d-8fc2-406c-a749-ef9898b6a0e4", "comment": "Malware payload (PhantomStealer)", "value": "081c694fe404f169903f2989e3616052dfcf0b2f91ad31c94f44f844598419d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827002, "uuid": "d7c2be3e-872c-41ae-9c80-635adf808e49", "comment": "Malware payload (PhantomStealer)", "value": "f0a90e7a2fed043a7ed7850e2b2e9c035701db8c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827002, "uuid": "6701ce4d-8e57-45d9-91f9-414a91bb236f", "comment": "Malware payload (PhantomStealer)", "value": "2c52264034fd1f99481d501149aaff6fe63bf412610709f7c7a75b6380887f1337e3d40996c9e17caa3e36cb140f6a35", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827002, "uuid": "d343980d-c447-4def-897e-88368aa53698", "value": "T1AA53FB7D8D1C8475A90BEB0CA901EBD8ECDBAC071F7C6FD4518407AEBFA449A885F056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827002, "uuid": "bb610936-e868-4bb4-a1b2-e3d0919b9150", "value": "192:ZvJXbiuMa/71N8irK+pHSccxDTtKwwhvoWwnmtZx42u2OpM6AdU/8w5HzQen3jOu:bjj6BOJ/QLQXR78uXxVP5cFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827002, "uuid": "66c1c5c8-f5ed-47a5-8c67-88f885b65dd5", "value": 62487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827002, "uuid": "aa806d02-bea2-4d3a-a8d5-dd2a50cae891", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827002, "uuid": "b4f630c6-187b-4985-aa34-b6a5dc757eef", "value": "20baf6a2e59647acfafeaca5f4fbe72a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e66333-2303-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773863353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863353, "uuid": "dc7e759e-345f-4187-a0c6-f12fd568ecc6", "comment": "Malware payload", "value": "a07d64be8d671fbecd1156510c3be01f", "object_relation": "md5", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863353, "uuid": "70328971-b5bb-4054-a98e-698efc808a46", "comment": "Malware payload", "value": "096806c86fe942083e273f7e8a731f42fe4b8684211e61f0bf8ae65a33be0773", "object_relation": "sha256", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863353, "uuid": "75abe6e2-a72b-4441-927f-d73488a5c40b", "comment": "Malware payload", "value": "2922effd9f21d23eb5ea1b40d850230c890abdcf", "object_relation": "sha1", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863353, "uuid": "c1e7216f-378c-454e-aa99-73f34928b5f8", "comment": "Malware payload", "value": "a7e31f029da05876fd34d9795d9b169b36508cbef3d48cb8610f9460755e87dd91c9e8f34b0d0667fa266d8782ab134a", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863353, "uuid": "27e63fb5-059b-4f92-9a10-3a0d2cbab0ce", "value": "T1E5083354838A2797CC5F6FBC40D2DA59970DFB8E87712245232B0B9C6827AF4974FA31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863353, "uuid": "e206d447-f1d2-406c-ad5a-2fc3e4a36877", "value": "1572864:6mFz6Ujmf11S4oIAK8R0yUWNm2Ic0CroLUxB1InYjtHXLC:dFzUfSzRaWNcCroE/InYjJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773863353, "uuid": "658a30f0-263f-41b5-b32a-a5a1d39927cd", "value": 80453048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773863353, "uuid": "8646d940-053d-429c-a8c1-f30d43372b88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863353, "uuid": "f05a0074-6137-4954-9987-4bbb04568242", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff74763b-2314-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773870851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870851, "uuid": "1004be7e-47e0-4471-b608-8bcf38b20226", "comment": "Malware payload (Vidar)", "value": "7d3dad92dacf27bed34c481d73158b64", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870851, "uuid": "faccfdd4-253d-4128-8d20-ae8986987a2f", "comment": "Malware payload (Vidar)", "value": "09d9941bce40670c7999f703a23ab965bee2750589dfb3272493bfb2bfb1c8ce", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870851, "uuid": "1d1a1d0c-9073-4190-b0e4-d0eab82e2806", "comment": "Malware payload (Vidar)", "value": "e23308feaef6e2c629b30d8dc9d63d444d067b19", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870851, "uuid": "48959f3c-5f7c-4f76-ab86-e290174cee41", "comment": "Malware payload (Vidar)", "value": "fbaf3706b35e5a85da4e93e8df10d15a9b8f2e14fc391393a9229a9bf47e008a13b749e4195351c55ceaf4ec501fdfd5", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870851, "uuid": "141c96fb-1f7c-4276-ac8d-50dd20b0aee9", "value": "T18A77CE02B7E84166E4BB473098B78652EA36FD511B31C3DF1294A26D2E737C0AF35726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870851, "uuid": "1d82b584-eb05-4ba2-acf0-892cfa7e0737", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870851, "uuid": "1f69d779-d5bb-4f23-9e39-075be97129f5", "value": "786432:ChMYc9K3nyzIBW/c9KckLj5l4T+p8XHrsFG:Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870851, "uuid": "b0be3a36-263d-42a6-9bc0-804c55b01646", "value": 34406912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870851, "uuid": "3d8fb559-144d-4be7-91df-4d902317dba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870851, "uuid": "dba9d0e4-d2f5-40f1-8628-4bb010eeba37", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1481e0-22ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773854414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773854414, "uuid": "da475f47-86f6-49fc-b34f-119a150decb8", "comment": "Malware payload", "value": "bd91fcebd2baf7d0b5304245dab11b4e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773854414, "uuid": "c7155768-6e13-4e3c-908c-496c2aad9739", "comment": "Malware payload", "value": "09db02307346921bb4e49dcf6f4b89c49584b994c08dbbecadd7f087c1c41961", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773854414, "uuid": "915ad11c-39fe-4994-8ec9-5ca38cdcdb91", "comment": "Malware payload", "value": "3d233c5f4c34c5865dd33e85a679081d2409fc49", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773854414, "uuid": "22ae3bd2-56d8-4ef5-ab75-a6cbeb3bf5d3", "comment": "Malware payload", "value": "bff04a72a2138f5ad44ad8cbbbe8fc6d3775e555e96927f824898874cec55d9301ec49dc893dd1f4b6716d0809da9708", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773854414, "uuid": "dd1035be-7b33-4ca1-8015-70b4146d9e68", "value": "T18DA5F1E6E11E0A3ADC27473FE6894911EBBCB795D80B30F739B4450D8953A851FC8A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773854414, "uuid": "5e52de0c-219f-40c0-b64e-37836b100413", "value": "49152:CQZtNQKa1SSVWdb7A6XZuaVjDZT+xua6ubSamX3X8mEhd:LeKag0kA6XZplDZTzVvJnXcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773854414, "uuid": "4820191e-c691-4f7b-8ab9-93222e9d89a3", "value": 2131452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773854414, "uuid": "0563e2e0-a525-4d06-af16-bac8085f2922", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773854414, "uuid": "28ef5e90-619a-4571-a770-5a3aed88e459", "value": "Wurst-Client-v7.52-MC1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0551cb3-2308-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773865645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865645, "uuid": "0d463a42-f333-4caa-b606-c534f83f6b9a", "comment": "Malware payload", "value": "12d0533a59606c38e5efe376288c803a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865645, "uuid": "b92bd5fc-b9fb-4e06-99ea-d09145c7db2c", "comment": "Malware payload", "value": "0a108cca92abc4326b5897466ed7c8f7f8737d3aab14f59a8d1e5eb4a48167b9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865645, "uuid": "a23d2828-7bc1-4cdd-8982-6ff7a3f88f7e", "comment": "Malware payload", "value": "046f4fc7e12c4c1cc65e146bdafbc232fc76615d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865645, "uuid": "5af57206-6cf5-4ac2-b929-8192c129fe14", "comment": "Malware payload", "value": "a1e56085749e961d35328265ae2d3406e2a04110822f108cbb802ace5b11f7655c4dab5707bf6989781442bef5fb7720", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865645, "uuid": "9e8ed8a4-558f-42cd-b21f-8350d57d83b6", "value": "T1B4E63352FB87493EFDF783360B76062A09058DA2C393964B6860763C2537FD48E91ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865645, "uuid": "6cf625a3-e147-4172-b3a2-50cf30387128", "value": "393216:nzcYwShTHwhHpuJsuYzUcfbB9ZJvgjvY3glb:NiFesscfbTi8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773865645, "uuid": "c861c920-4ec2-47d5-80d0-94150ee6eb3f", "value": 14451452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773865645, "uuid": "fdb61612-4f56-490c-9aae-9e6bf9f2d76c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865645, "uuid": "9209a218-0b97-40cc-a11a-60669faa527c", "value": "0a108cca92abc4326b5897466ed7c8f7f8737d3aab14f59a8d1e5eb4a48167b9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4fae72-2267-11f1-a769-42010a9c0008", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1773796144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796144, "uuid": "fad46ac4-4ddc-4d1c-8b72-e02849af9360", "comment": "Malware payload (ArkeiStealer)", "value": "8988944e4d193aab8d6ab1ceaa22218a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796144, "uuid": "824842de-15df-49ce-8695-2ecfe50931fe", "comment": "Malware payload (ArkeiStealer)", "value": "0ba4ff2085ac7ffa2386adad160f53623f77415e623a34189f4d5728354a03ce", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796144, "uuid": "2c275e4c-12ae-4e74-a548-885c1498ec1c", "comment": "Malware payload (ArkeiStealer)", "value": "26abe22f1f871c74cb48e27edeb160c2f43ce31a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796144, "uuid": "3be4d35b-034a-48e8-aefe-eefa474b586f", "comment": "Malware payload (ArkeiStealer)", "value": "55d8dcda12a327143d8c9b3fbc476a5b524f6e54cffdd21db2741ea41019a0e5cec2dc4e3ddb0b5bfbb7931b8ac345bb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796144, "uuid": "05aab594-e47b-46f2-a783-0e60f7f442f4", "value": "T1FBA7AD23A251C96BD39A0031CD6AD2BA97647D1C5BF562F7B78035EEED322C53B39201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796144, "uuid": "06ab559c-b023-44c2-a066-89f7ce772bd2", "value": "fbf31ebc1fe79f66fd12e09bea1df005", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796144, "uuid": "7da99869-9866-4817-abd7-2379f3d872b0", "value": "786432:VxSBxXBXX/RmjYv2F3jza8xd4OYqdwMKEMJUefhOq4XO:VxSBRBXX/RmDa8xY+MLpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773796144, "uuid": "09120314-e650-4804-8a29-7664575f98c9", "value": 44134400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773796144, "uuid": "44ec133c-6ed2-44fa-9e29-fa05bf1c5e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796144, "uuid": "36277496-3e45-4b88-84ee-7602c8f9152a", "value": "T1000-YK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907b0ac3-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773827715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827715, "uuid": "c122b39f-a8dc-429f-965d-56ab50532ec6", "comment": "Malware payload (AgentTesla)", "value": "a48250f0b465f19ca28f04d6e11db9a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827715, "uuid": "e6e5611a-38b9-4d29-a042-e1d2819f9ab7", "comment": "Malware payload (AgentTesla)", "value": "0bf1db2a82cb2139c6f68d437bb2ae06eea34b6d6b189dd2683fa8fe9402c9b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827715, "uuid": "c10a40a0-7a9a-4e3c-a0a9-5815bc6f1f8d", "comment": "Malware payload (AgentTesla)", "value": "c3c287b396f3d19df1090f4b76b38bd4929896b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827715, "uuid": "911e5732-4f1c-49d1-8a61-46199e5e8561", "comment": "Malware payload (AgentTesla)", "value": "1536a7f04aa57f6b5cc13c65db70533047916ebf64d08c9e77ec10197b91269c5dce16d976fe54512bbed991ab72d050", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827715, "uuid": "c4548f54-df56-40b2-bd45-4bafc1bcaca0", "value": "T1AB5512EA03EEEA85FC977ADDCD6234147810058A5C5546B466C2B1E3CA46B27FBF780C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827715, "uuid": "57801715-a893-42ba-a9b8-ec677066e6eb", "value": "6144:7kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk/:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827715, "uuid": "a6e50a69-a722-43d6-ad9d-46b6c5a51d94", "value": 1358273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827715, "uuid": "723a429c-35d5-4ce8-a0ca-57fe4df2ce2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827715, "uuid": "8483441b-2a75-4cc8-beee-7739acad1361", "value": "a48250f0b465f19ca28f04d6e11db9a5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a29408-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801516, "uuid": "f5b8dfac-d274-46aa-8848-4f5c4bd5c04c", "comment": "Malware payload (Mirai)", "value": "42b0754f29aaf2c4483803f4eed1c973", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801516, "uuid": "0414c7cd-3194-4527-ad3d-af30a483e4dd", "comment": "Malware payload (Mirai)", "value": "0c905e25b8a3b00df32dceb0fb7ec41b3c28c54f52fbedd65b6248b899806aeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801516, "uuid": "7ffe107f-9e1e-429f-94fc-9eb8d5dd1c74", "comment": "Malware payload (Mirai)", "value": "f69fb51eb58a15b27994fae98e008f838d3cd305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801516, "uuid": "c0c5a472-776b-4a83-a666-6d79a5c20462", "comment": "Malware payload (Mirai)", "value": "9596ea9c01e0f23f9570841dc15ff98378c5719b10526c214c697e071c886d1ba6cc0ca6046d6ffb2c05b185f285cdb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801516, "uuid": "fb815745-077e-42fc-8093-35a937c4ee2e", "value": "T158830995B8814B12C5D512BEFA1E118E3323177CE3EE73129D206F24778B96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801516, "uuid": "d29094a5-4a19-4c62-90e5-0c7953f303c8", "value": "1536:ejnkw7UG6VylcGovNuXfR2au/x5DQWbMSibm48TPtX7pZ5wY1s/b:cUtVZrIfR2au7148TPtX1ZaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801516, "uuid": "4aac1c82-0a5a-4b99-99e3-db1b18615f72", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801516, "uuid": "875d7a2a-c91e-476d-b7f4-6b19bb11fb79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801516, "uuid": "e7de662c-37cf-469e-8462-80e2f26f4e4a", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41344c9b-22b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773828441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828441, "uuid": "1f0d4237-548b-4c5c-9ce0-29cc84739f85", "comment": "Malware payload", "value": "b8791e6876251df5e613ec337667e1f3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828441, "uuid": "abf25c65-f863-4e80-a06d-7fc5f8e98a0f", "comment": "Malware payload", "value": "0cb8709bc1b0ca80686674e168b68fa8197b756de71ce6a401a9159661a316a9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828441, "uuid": "b375ce48-5bb5-49d5-9211-c40a65a25193", "comment": "Malware payload", "value": "871f2c453741e8e1c4627a506ab0f9433a8c7497", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828441, "uuid": "3b6a2677-9200-4cf7-af17-b589b4bed524", "comment": "Malware payload", "value": "7f159d5e8c9507a7f25b2939489d82f1c3906e2030a4b5f3dba2b406d8a531de4f83c3e61364da63a79506150a48a819", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828441, "uuid": "b80959e8-ef1d-4dae-8a73-b3a9831141e1", "value": "T10F3103102AEA271CF3F28F396976A750487BFD68DA25C69C01A1854C0833F298969F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828441, "uuid": "c7bbd1fc-1acc-42df-bd33-2eccb0714f6b", "value": "24:8A0uPbkHjWyYPE+ODdenwQWvkJx7r8byN9sddCE/zVo:8bWbAgE+ODdenEcD++9sdPzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828441, "uuid": "b07aec65-59fe-441a-b0d5-2a51abe01aa4", "value": 1816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828441, "uuid": "23d7581e-9078-48ad-a829-b6b543230d7f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828441, "uuid": "b9b43db0-8442-41c9-b7f3-9932f90c493b", "value": "b8791e6876251df5e613ec337667e1f3.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10a55a4-22e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773850641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773850641, "uuid": "4e33861d-04fa-4bfc-83d7-889aa189fc29", "comment": "Malware payload", "value": "3bac274b33921db93b23d02dcb4cb9f3", "object_relation": "md5", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773850641, "uuid": "35561674-d91a-44d4-9641-3041d67cd040", "comment": "Malware payload", "value": "0d2797e19cad0ec93ac676e6de2cbf7b849395c86bbc3df1391c91e19b8d1dde", "object_relation": "sha256", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773850641, "uuid": "842726f1-1452-4f8d-b731-233679aa86c7", "comment": "Malware payload", "value": "e0eae64547d43081b9996deb50f96964f43b1a39", "object_relation": "sha1", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773850641, "uuid": "6aa0d7d3-65cb-4447-a6b1-89c31620985e", "comment": "Malware payload", "value": "379e9b77cd5a83bacbe3186fa2fd4539c88c00839b5eb20915262b18ae0debbebcb900acc4133658203763e8a25d2e4a", "object_relation": "sha3-384", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773850641, "uuid": "8b386eeb-8d65-483f-ac7d-e088b41f9c21", "value": "T12E54236DBA5CA4CED911742873F2257EBC20E50FEDAEDB2B774490828EC3C5015A0F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773850641, "uuid": "0e2c5e9f-e9f3-475a-85f6-cd6e4ddebaaf", "value": "6144:5Ftb40qcSx1QmesvwHendkMhpjf8htutoAYbH8W67NmVJX2pgU31rm:5DhtSI6w+dNhpwTnBzeIVJXpUrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773850641, "uuid": "0cd69b03-367a-4ec0-8f13-ceffcffe8fd0", "value": 294252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773850641, "uuid": "039a002e-f5d5-435d-a872-790c6831c5de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773850641, "uuid": "25ebabdf-83a4-41c9-b34a-bbefd9aed280", "value": "verificationapp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddeec4c-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806827, "uuid": "e2496b5f-92fb-4c4f-badf-757f57ca79f9", "comment": "Malware payload (Mirai)", "value": "ff67d4e7e7d5e3da10aaad093e79cdf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806827, "uuid": "c77f5e63-e316-4d5d-98ee-308b81cca646", "comment": "Malware payload (Mirai)", "value": "0d76dfc93254e3fda0d60c4c98cd46fb8d9583c19134d0fef292b59a9a2f6675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806827, "uuid": "a68a6ab7-844a-4bc1-b67b-861867aae266", "comment": "Malware payload (Mirai)", "value": "9e7d20d9c59c4e21d4f8b05629eb9c6156cba7ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806827, "uuid": "13828f6c-3563-4c5c-a1c0-c12b0309d9c6", "comment": "Malware payload (Mirai)", "value": "e5e2191fb58adc8283790339d3e1abbaae9b07272f52dbed19dd051ac10ecb5bef4f1ca7c5481f63627c230f6eb1f08a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806827, "uuid": "bdba94d2-f3c2-4f0f-abf1-212ef7325178", "value": "T141F38D32D8696F98C255C434B0F49F782B13A5A1428B6FBE69B6C3B44083DD9F505BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806827, "uuid": "5e4d9c98-6dd5-4a36-916b-4c393cddc257", "value": "3072:F4i13ajXSHWZn8bx7H2bMHCHUHWYIN2byce:F49jXS2Z8bZH2Ar2Y+2bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806827, "uuid": "83617f60-4387-4da4-95fd-27974092487f", "value": 167776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806827, "uuid": "35c71f78-d7af-4d1f-9121-76c77ec04656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806827, "uuid": "284898fd-d702-4c27-beca-2a94a0e9eb44", "value": "nuclear.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf2e344-22a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773824409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824409, "uuid": "a215d2a7-4681-4e1b-b5a3-feacd899e7b0", "comment": "Malware payload (Formbook)", "value": "9197456b2b82d4b900cdee86fe753d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824409, "uuid": "5faa4772-4088-4625-a030-578d952b76d3", "comment": "Malware payload (Formbook)", "value": "0ee1d5d6cd40ca035ae628632e2ccab0733f04d4a0d6c21a705993166c29761f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824409, "uuid": "67efa05d-7854-4c63-87b9-af6ca7c8bf66", "comment": "Malware payload (Formbook)", "value": "3054fbd7a8309ff5cc30db325e50053eb0377740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824409, "uuid": "ebb789d4-e070-4294-b90f-297720aaf790", "comment": "Malware payload (Formbook)", "value": "d28c0e41a15773bd35a01c9ee6bf55847d11970d49235b53a6b454e413c528e443dd5aeb180856e7756635470525c3fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824409, "uuid": "84a367a0-2433-4936-9543-227ac7f9c710", "value": "T14D35F1186A59D801C6A59BFC1530E374827C7D58AA01D757CEEEFDEB79386C638002AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824409, "uuid": "0f54926c-3ce8-4f60-b8bc-2bec149bea71", "value": "24576:Yo6dFpdcvkIZciaOS0w+nlJntqxjtNN7hSeglJOBjIu6N1:wcZcgS01JtqHNN7hSzlYBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824409, "uuid": "0c958f77-6f47-4d23-a63f-aebc8a984ba0", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824409, "uuid": "aeb210e4-dd2e-4708-b382-02b3f514af2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824409, "uuid": "1cd7e12f-491a-4c59-b139-6af519af3c84", "value": "rMOQ-0561303-4012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806c3b49-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801489, "uuid": "5d419bd5-08d3-49e1-b399-6f7ee327e5d6", "comment": "Malware payload (Mirai)", "value": "d77834c0f58591d67de63524c2d7dffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801489, "uuid": "d3c30f2c-9fa9-4586-9b97-7698a10d5813", "comment": "Malware payload (Mirai)", "value": "10811d1483f61157e47497de620851d819d458e717735462434def8bccc63f1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801489, "uuid": "b208bcb6-e645-47f5-bcb8-3aad16681fa6", "comment": "Malware payload (Mirai)", "value": "9c5269953f68c10076e27edcfac2574987cfd27c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801489, "uuid": "1a8bf874-14d1-4d37-ba8a-92501a1025ba", "comment": "Malware payload (Mirai)", "value": "533e2b1391669defab93944bf58c1fe29417c0450d658df5afe4a20ee714cd4686c8f9b337fbe3208fc115ef800c6aba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801489, "uuid": "16ef3b2c-c3f9-47ef-a889-8a8f5e4816d7", "value": "T1F3735C22BA751D27C4D4A87A31F30721F2F2479A35AC8A1A3D720D8DBF25A5032577B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801489, "uuid": "b8db6812-b1d9-47f2-a04f-f7fba506f167", "value": "1536:ENwhLdSFmrwsPlHMF/eLe4c7m9bQRStYS0gNM54sHqd9oXADtPL8/QUp:ENQYQrwdOevSkS+5gN84sHw9dDUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801489, "uuid": "a47f8d06-8a60-43ef-a9d6-00a750ddc877", "value": 79880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801489, "uuid": "5fc6b63f-cf0d-4314-aee6-464f55464abd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801489, "uuid": "acbaf5f4-61f5-4ede-b0f6-f932dca8ef09", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3665b6-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773827571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827571, "uuid": "83cedd79-1ac4-4dbc-8d67-4d5c76e79a05", "comment": "Malware payload (AgentTesla)", "value": "c23c47f9f6e0cf8af45110abbd5384d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827571, "uuid": "38a26f75-42c5-47b7-aae4-786b2b531f7f", "comment": "Malware payload (AgentTesla)", "value": "10d4de0581426b6d8552f8bbe6c61265757136a23ebc6075e8b80b51dde7edfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827571, "uuid": "296fb27f-b604-4f96-a3fd-76d3df28a1dc", "comment": "Malware payload (AgentTesla)", "value": "0f6d53def08276a40174ec74e524e9714d27aa2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827571, "uuid": "9daf3b73-4aa9-4c44-b07b-1d3f269d1172", "comment": "Malware payload (AgentTesla)", "value": "3365f622c853497592472505930392ad122a933027e1dd65ce31174d14f58fdd0fa485dff09fd364139a328b3678005a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827571, "uuid": "212cac23-cf34-4214-a62f-36bdb0004e27", "value": "T1D14586B0C44CA9693D284F9EFA2B0C57DAC80792B47235A005F7F7B52FB894C925CE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827571, "uuid": "0d33431c-a2f0-4f70-9a32-7ae0e358d0d2", "value": "768:SIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIQ:7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827571, "uuid": "30af655b-f7cf-4232-8d2f-11e422e6794e", "value": 1199233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827571, "uuid": "3b9254d6-2648-49ec-9644-eb24d1d76a12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827571, "uuid": "bba3db4c-bfa3-46a1-9e9e-63c83addd132", "value": "c23c47f9f6e0cf8af45110abbd5384d8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01fe79a-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806831, "uuid": "c95aef17-d7ca-49e5-8067-59b885ba915e", "comment": "Malware payload (Mirai)", "value": "be6a8e08039353d786a71932a3ec9223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806831, "uuid": "da3b2b61-6ec5-4886-8cf5-73eea6a7dd47", "comment": "Malware payload (Mirai)", "value": "1126ff66050524c1a9eeda89db25ad6c2b3b373282f1a2c5e6697e22ee25c54c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806831, "uuid": "3fd1b9e9-a766-4f98-94c5-ad09bdf545b3", "comment": "Malware payload (Mirai)", "value": "8dd0904b0d021b7c6b70babd74c89a1e8350289e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806831, "uuid": "dc815132-fb6d-40de-b500-3d148de488c2", "comment": "Malware payload (Mirai)", "value": "c3292e872f74e2475a644393dab7f5d5b825067a2e1aea10f52d25fd00cb8334f2d35b4767eb5010640bb81b9e71dbfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806831, "uuid": "8a097bf8-5e21-46b1-816c-59296f7db088", "value": "T186340A16AFA10FBBDCABDD3705EA170129CCA44721A43B393674D928F54E64B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806831, "uuid": "217095a7-8edf-4563-9990-c964e92d6d63", "value": "3072:dopMix379N5BaQ85SKRmu2aJZnqfuqlepGdUQRbHyUzF1l5Jjk1Y7/CLcg:dopMix3NbAFqNeoUQRuUzPxjkY7CJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806831, "uuid": "c8c95dff-dca9-4381-b341-b7afbca36a6f", "value": 252680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806831, "uuid": "d90672e6-4eda-4ae7-ada4-9393f3d9261f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806831, "uuid": "0960366f-4ecf-4eeb-b0dc-51546adbb4b0", "value": "nuclear.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd79672-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773827119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827119, "uuid": "f24aa4b3-1d91-4984-ae67-2c9cf90fc60f", "comment": "Malware payload (XWorm)", "value": "34e49d45f1660663262ff205105f9a51", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827119, "uuid": "dd32fada-a198-4fa8-a2cc-cd198db5ea1c", "comment": "Malware payload (XWorm)", "value": "117b6d4f0cecd5b8dd0ee6724ee74cad71de16f9eec66fe30dde457773413241", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827119, "uuid": "da2aae7b-46da-4795-acb3-7c1cf7346c96", "comment": "Malware payload (XWorm)", "value": "fa1c880e7eff3c4e266a5577361e93084cd21fc7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827119, "uuid": "73a836f3-3def-4147-8718-ce76a4e750bc", "comment": "Malware payload (XWorm)", "value": "7bef3b0c229ad84b646ed4c797a49682f135e5f55dd5344455f12557d5b22916ae3bfe69e12f643ae15febe1904eb3a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827119, "uuid": "4a797593-2577-47a8-9d49-9bf4b5c1e7b9", "value": "T1B285B9A213EF1649784D9C6826139B92DE1DE34E1673F0DF77BCBB8992B860D80605F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827119, "uuid": "f2e54e45-4a2b-40d9-b7e5-a04e4c6bf79a", "value": "96:NXMSbvs+cAD+Luyc7Gj8qchiwOpjsbBA0c+yKwSd/lGQLmZ2E9l4IrcewXNW9hpX:FXbvBHcfEKLbkWma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827119, "uuid": "8f104042-3fac-4c91-804c-a9aa0067ee63", "value": 1766784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827119, "uuid": "2fcdd970-e3b2-4a47-9f70-ac12f24e66d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827119, "uuid": "af6e4180-e6e4-453c-91a9-1203784fa869", "value": "34e49d45f1660663262ff205105f9a51.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9529ce70-22da-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773845762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845762, "uuid": "f60896c7-67a3-462d-9ddd-2ded447908b6", "comment": "Malware payload (Phorpiex)", "value": "f3c7647e32dc50706c17b67379223c08", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845762, "uuid": "67812f86-61b1-401f-8a5e-7b738dfe6407", "comment": "Malware payload (Phorpiex)", "value": "119d2a5b3bcfb26c18c65618489b3e03c67526b6f157de00f77f7b237646004b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845762, "uuid": "d558dfb6-8eb6-4ec2-a089-7b28d4d58975", "comment": "Malware payload (Phorpiex)", "value": "759a3164ef3d7a66ac35ee6b695cf9bc8fd7e2bc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845762, "uuid": "6cf48589-de4a-4d1b-b535-dbec787418db", "comment": "Malware payload (Phorpiex)", "value": "ca7df0139216069a30f7e0f168b9f2a007c25492d48ffdec59924ea00415549f240e8a25b80879eca697ffd566b61963", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845762, "uuid": "26c30c69-d028-48b3-a060-a85c3e7d075f", "value": "T187B37D2034C1C432E567117988EAC7B54A6DFC310F75A6D7BFC406AE4F2A6D29A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845762, "uuid": "d8cc7bcb-e237-4ad0-b42d-94f6d4b5fd78", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845762, "uuid": "d1fec2f0-6717-43ad-a297-8f4ff8c51da3", "value": "1536:Rw+UyWjepd1MXyGzmfGut6daLMrVMySa6YE40Y75702q:C+UyQem1QGW8aL+VfB0Y75702q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773845762, "uuid": "1f670c81-7264-424f-90b5-596054edd537", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773845762, "uuid": "9253d8b7-e418-44a8-8710-f642ab8baec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845762, "uuid": "3d6a809a-8e62-4548-a074-7bada0cd58ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30075f50-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773827124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827124, "uuid": "59711811-a5c3-4719-affe-726f2714c71a", "comment": "Malware payload (a310Logger)", "value": "020c8136e438e91ced1b8a0cec225c7d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827124, "uuid": "1024667f-b819-44c1-8275-e7158a5d2cc8", "comment": "Malware payload (a310Logger)", "value": "12576f810e5650ce394b5404e4a0dcad18c9251405a4ec095ad2518de37bd342", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827124, "uuid": "d5a4b985-122d-4574-9ced-f494f6ca6b9f", "comment": "Malware payload (a310Logger)", "value": "e3d0284e7a5069e0ad67a3f20082cdf3b26c78f7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827124, "uuid": "3a4d404e-d6cc-4a27-b63c-fa9b567b31ea", "comment": "Malware payload (a310Logger)", "value": "89a1ae8b617426f49790c5c8b26ff3c5c12db5c7d44134a21bf4e5630e86830275d599583a9295769ba3b1285eafb3a1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827124, "uuid": "a9ca7d4b-3acb-45c4-a56f-91304e21f3ce", "value": "T1CDB5BF25EA902B79DF592E1D08FF4D193BA31A763349AF4EE25F1C285BC3648B21DC11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827124, "uuid": "200f81a8-d171-4bb6-96ea-f292a2951d31", "value": "24576:kG/b555555555555555555555555rFCoFhP55Say0FKu53mNyfHicIj0XUkA8cRD:0wVnlcVdYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827124, "uuid": "c232811c-903b-43e1-8083-103030a1172b", "value": 2355167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827124, "uuid": "afcad1e4-c62d-47be-b1a2-7acbf2edb438", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827124, "uuid": "32a23374-827d-4318-99d2-838e2b5366da", "value": "020c8136e438e91ced1b8a0cec225c7d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b63b1c8-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773826445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826445, "uuid": "cd3da49f-b84b-4d35-8df5-041b34899c02", "comment": "Malware payload (PhantomStealer)", "value": "aa7539553f776d952cbce975857c52d6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826445, "uuid": "96e5cd56-eebe-4f5d-b90b-da336f9432ed", "comment": "Malware payload (PhantomStealer)", "value": "139d9f5d81e738f61f5a166496beba029eeca959d2997372fb6e499282d65f09", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826445, "uuid": "d05b390b-533a-4cad-8235-60b8151e9aaa", "comment": "Malware payload (PhantomStealer)", "value": "0485102ed02b678341afbb10c3a6be9d281b6dc4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826445, "uuid": "371ec6a2-1e8a-4f46-a3d5-2da6aa37f19d", "comment": "Malware payload (PhantomStealer)", "value": "95b17c2cd1017a104fdc98e0361788fc9ff4e16fe445e12426025f02fdd456d87eb16b4cae1b7dedb16fc08571bbd459", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826445, "uuid": "29a6df72-5762-4702-ba5c-46271f336ed6", "value": "T1E142E9BDC9E1ADC0475B32C0B98EBAC501DFC7037A6B2B9CB2C844511F546A5EBB918D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826445, "uuid": "4dcdb1cc-89fb-49a5-8423-e40b9ec6d169", "value": "384:GFRrDr9s2bHcY/nC2dN9T/5xWN1YxR2QIFd0zVTMp9Kl15Ph:C3b8kVdLr5IMeQCd0zC9Gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826445, "uuid": "f58bd22e-d3a8-4838-bd83-388b38f1e54a", "value": 12848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826445, "uuid": "7859774b-ba57-417a-9990-e53bd3c94909", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826445, "uuid": "e37757cc-e4aa-44dc-938c-7a141fc1c569", "value": "aa7539553f776d952cbce975857c52d6.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0312b1-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800943, "uuid": "5444760e-b85a-47d6-aeae-d77ffdee65ad", "comment": "Malware payload (Mirai)", "value": "861b46e31c9bb2f6b1354f00af2ee2ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800943, "uuid": "4972ff98-6068-455e-b8ea-8dc9ddc29e08", "comment": "Malware payload (Mirai)", "value": "13a6cab2890be3448131394a967ecc7b428327e2465e4b767436909f07f89d29", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800943, "uuid": "e7064a44-248a-42d7-aad7-405c14954877", "comment": "Malware payload (Mirai)", "value": "579c98954426e3e1851f6d61a3b4fd26f6c70cc9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800943, "uuid": "b75215d9-3ea0-422a-8e87-8b23eb2aa868", "comment": "Malware payload (Mirai)", "value": "55b674836fb519148da89a0ef818a02afe84ed148fd09cc9eb544abfc4fdb949208b132681f4eeec96f9c5760cb973b5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800943, "uuid": "3437d269-e8ed-41b3-ac08-9e9506bfe63e", "value": "T164416099E17304FC6D988A49396F77107284948128FB6F4F68CCBFF940CEF00E612666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800943, "uuid": "de7c88ab-4478-4af4-904b-16dac7956061", "value": "24:wuYWYLfLSbNISCUKN9SQ5xMN9wUyAG7ciP8aDmFkr+3A:wu7YLfL0CUq9SQ5xMN9w571P8aDmWr+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800943, "uuid": "d151467b-0bdb-4e70-ae9c-bf97267bed4d", "value": 2435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800943, "uuid": "70a05a4f-dbfd-4c44-9323-c708a33a2215", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800943, "uuid": "8dea0259-8686-4191-a96f-e8e9bf9d69b0", "value": "splash.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811e02ec-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801490, "uuid": "ff2f598c-2011-4e3f-a038-d2b5db85910e", "comment": "Malware payload (Mirai)", "value": "771f15db953125f8e9ce55e222e49a85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801490, "uuid": "801edc80-f7c7-43ef-995c-cf448ce13e06", "comment": "Malware payload (Mirai)", "value": "145fb86b0251c7fd6a5e30c00c94e00431917e8fde07c21376b6f34b318ad622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801490, "uuid": "29c56682-f804-42fb-bc3d-dc005cc76f37", "comment": "Malware payload (Mirai)", "value": "9c3cdb5da70038ee4e6bbd0d12f7c633603096fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801490, "uuid": "c46a76e9-d3a3-48e1-8684-abf110605107", "comment": "Malware payload (Mirai)", "value": "b0fc8e72e7ce76497f9d0e8bdcf596e7b7c47353e36497d738648ab5108d3d1d280cdf2588e25f5f1f9cdad2586af101", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801490, "uuid": "9b5e26be-e9fb-46da-b880-ceab9686fae2", "value": "T15F832ADBF800DDBDF80ED77B48534906B231A39256830F36635BB963BD371A45826E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801490, "uuid": "c3838688-e3c8-4303-997a-89fe051dea44", "value": "1536:sEGf0hcnh/L960Ficin8py4uF7R8S95haZc6zV6NjLHZHzOnosVLXyx:sEGf0hoLLFiciEy4uFLYZzzVK1Ono22x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801490, "uuid": "13a94e24-5a20-4113-9597-94be82d52da2", "value": 83276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801490, "uuid": "1471f316-c847-4b50-a940-615bdedfbe57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801490, "uuid": "e07e9c92-fbed-46c9-9695-abd51affa3ef", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d1b348-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773825063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825063, "uuid": "62298e0f-2118-4791-a8c3-6309e426007d", "comment": "Malware payload (Vidar)", "value": "ec67523310c70ad748e8f4e8255469b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825063, "uuid": "704e3241-4658-40f8-a393-1af8ffba0c14", "comment": "Malware payload (Vidar)", "value": "1633b011b5f00fe9f2453775bc46c28750d803180d728f813d9d5d3f3a50d6dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825063, "uuid": "ec9ee0fb-4682-4947-9445-acdcb90d3189", "comment": "Malware payload (Vidar)", "value": "170a987eb0635c31af3f3ceb3c497491988fa346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825063, "uuid": "68ea3ee1-b222-4ba3-83e2-b1dbe2a8e9e3", "comment": "Malware payload (Vidar)", "value": "f4bc82576c0b01477c5820dbe45bbfb0f643ad7f0c51ecc658ce21e1bc8e7b4bf63cf96729f6e3f1a424055d0afaec63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825063, "uuid": "bf3d031c-8c48-4e31-85a5-f1b9bde35e20", "value": "T1A3B57C10A0048034FF301578C95DA69CC99D9A66236369DF6BA618792F358C3BBF5F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825063, "uuid": "218069b9-0908-4b22-9c3f-92add1414fc9", "value": "bcf77c2c3cd3748f83f9c44cda23fdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825063, "uuid": "33e19e9f-c228-4e3c-a17d-459332acb715", "value": "6144:VS+jiGAdY96ZBOCgX9DKt12tKbA0DyvE3yd3Kb:VS+jiNY9+gXdztnRvErb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825063, "uuid": "73ce2377-e0bd-4e9d-8f4b-2c48e3c39631", "value": 2478826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825063, "uuid": "82855f86-c93e-4214-a18b-658d65a519f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825063, "uuid": "b5ba6898-1dab-48f8-a870-b9a46746ed65", "value": "ec67523310c70ad748e8f4e8255469b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42db6c9f-22a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773823720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823720, "uuid": "847e73ca-63e0-461d-81d4-9162dd3b511c", "comment": "Malware payload", "value": "07696baa1caaa34d526a11aeff579ccc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823720, "uuid": "3c5afebf-a412-49ef-93c3-0e7b59a0e464", "comment": "Malware payload", "value": "166222f63917cc578810322e9b8cc3da845217fdee78fdad7639b124f6f90622", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823720, "uuid": "071a0b8c-3bf0-4462-8a14-9c0bb199ff2e", "comment": "Malware payload", "value": "c542f08ad55d9acf75e4a6f35e221eb51cdd85f0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823720, "uuid": "c646aff8-d310-4363-84b0-b5648a456999", "comment": "Malware payload", "value": "77dfe282cb64fa20ff6102126d0dadf2cd58db8d94aec5d8b32ad2fcc83773877f69e8e0a2bff800747b67dfd6d9e0c1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823720, "uuid": "418b1218-37c9-4872-bb78-bc937dee2c28", "value": "T17DE0F110533A310F4DDFD1DA480890DBF99CF2C803363EEBA9C4BC0049411C95E9F409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823720, "uuid": "8406f047-d99f-4cd8-aa34-bc6ed3cf18f5", "value": "12:wbYVJ4JFRX4984CXLgyaIS1PKC2ALFyGHDfhv4T1MnGv4FSk1N:wq4jRoEXLw1PKC2kFHD94Si4Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823720, "uuid": "d282b06a-762b-4706-96cd-a3c76530ca8d", "value": 411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823720, "uuid": "f4791537-8b00-46ef-8bc9-f69ede092853", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823720, "uuid": "74005137-6cae-494f-8c9e-1f83979346d2", "value": "33.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258bbe40-230d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773867479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867479, "uuid": "9f28c3ad-8277-4880-af31-d29950ae8227", "comment": "Malware payload", "value": "2acd0425bc413a139972796180a036a5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867479, "uuid": "e48cc979-ad3e-45b0-8765-2ea2dfdb03ea", "comment": "Malware payload", "value": "16b8310d44a5a0c96539cca1eb04396020337e7a6f9b97ebc5ee12739b87f13a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867479, "uuid": "8ef3ab5d-e9cc-426d-a071-755770a23728", "comment": "Malware payload", "value": "f15b00c8f6c99f098036136c8886d74e9e9fd03d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867479, "uuid": "b07aeb3d-599a-4f0d-82dd-c142b96027a3", "comment": "Malware payload", "value": "b8be3d7036ff6f32aa6bebdb54cbb904bcdd0de087f6974c520c51d4110f56ca4e1e3b5c5b8d6c76b3b3130fc57f8137", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867479, "uuid": "c785334d-a284-4265-b145-c7ce31779f05", "value": "T1B9D25B503FF18708F2765A7FE976AE418626BA0EDF31D74D535C840D18B4700DA69B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867479, "uuid": "0f0ecec2-c1f5-4e35-be4c-58b0758f07ac", "value": "24:8d/ey/VfS4Pi7xe8pF7cu6rxmN4CsnPa:8lPtf/0xe8pD6lmUPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773867479, "uuid": "2d95a705-ff53-4487-8d11-5e646a121d65", "value": 29171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773867479, "uuid": "516042c1-0557-403c-aec4-52e987176ac5", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867479, "uuid": "34ca7e15-6a9a-4659-a601-28129f9d03f1", "value": "Dodatok_1_do_zapytu.xlsx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db806e8-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851763, "uuid": "cf4a147c-b367-4290-9f8a-3636f710f4bb", "comment": "Malware payload", "value": "64c8bdd5995595b8b16e0df7d9404d4f", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851763, "uuid": "4f0e124c-d0ab-4cc7-bb38-1f3a11ca920a", "comment": "Malware payload", "value": "16f4bd6bb95846722057f10f9d7b5cd422073abdfa28e198032de0ea5f46f6e2", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851763, "uuid": "644ae063-caad-41ef-add9-979e68f49afe", "comment": "Malware payload", "value": "79c64a3079b17a6e60a1040b805be32c4f9e8c8e", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851763, "uuid": "51bd8b94-5e50-47ed-9249-6075bfd08be5", "comment": "Malware payload", "value": "b562a785d65dd843a203929b2f9a3f895dc7379ebcca5cafaf1fbb753729dbb2438266ec682b437f131f48cd1e5dc651", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851763, "uuid": "3693568a-9e81-4c3e-af50-d2eb6ee21610", "value": "T17E653300CF691A2709A8C234B11F2D1B9DB4AE69D0BDA1AF75F494CB0FFBF24546D528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851763, "uuid": "161aaef8-fe82-4b3d-828c-242e5e358e69", "value": "24576:tiozX2P8fO0xs2QbId+V8dVENAkDVo6bk8RnyPU6jlFlopWYf2hYVoUi6PHvkMwm:nR206ILj3kNlf5f2ciwyulx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851763, "uuid": "67888171-861f-4ead-9b79-3cf22f64affa", "value": 1520504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851763, "uuid": "ba81e4cd-bc35-490b-8e82-93df8a512161", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851763, "uuid": "0d78602b-a441-4311-acdf-336f548f39fd", "value": "1SPhilli-MAR17-Vioooo.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb63cf5-22f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773858443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773858443, "uuid": "e373d8a5-51ee-479c-8271-e0fd88efeb2b", "comment": "Malware payload", "value": "3d9d028013e18c22a7fc25d9ff8da645", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773858443, "uuid": "4b4a3ae2-7905-468e-aac4-578fc31aae05", "comment": "Malware payload", "value": "1726dc7c119469dadd62cc63c9c9b087bc6860a3a38b8387b25b2e4d0122bba4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773858443, "uuid": "a89971f1-22c5-443c-9d8f-9387a23db953", "comment": "Malware payload", "value": "68de652b316fb9fc7a59ee36eb2706a8a318a99c", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773858443, "uuid": "fde0b3e2-4202-4627-8dd0-42998e689157", "comment": "Malware payload", "value": "53f62006064c75c6dfd48d5422649f4b7c64df042c9d9765b1f31576d7e3583938a8c2d6470c5c93ebfc9719b12233f9", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773858443, "uuid": "5e21f3c0-a183-447f-bcc6-0c9991357eab", "value": "T160B3538D8C4E9D75AB86B834499F7D4B3BDC4282170FC55276AFA9453F23E24218FAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773858443, "uuid": "0564bb5b-a08e-4300-87bd-9a959b7a9e68", "value": "1536:42PVbY2ASx46M5SKWZFWZZyl35PEvcXDm0TB1Z5mQDmwDJTJ1R+Ju7a56g/e:ZbY6McKWZFWLyl35PEvcXDVmQDmaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773858443, "uuid": "60b5d6a6-020a-4c40-a1f7-47820abf53d7", "value": 111835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773858443, "uuid": "e5805eea-13cb-469a-a61f-5b524d44d623", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773858443, "uuid": "d2f34ad6-e878-4b9c-b3f4-a35937593004", "value": "Work_Fusion_Data_140.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075c499a-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827056, "uuid": "28594dae-afb7-4054-a9d8-2451055c4698", "comment": "Malware payload", "value": "26f44b7ddc4fdf3047c8dd65cde2d8ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827056, "uuid": "603aa06c-b53a-4c75-b7c4-df9e4b79e7bb", "comment": "Malware payload", "value": "172868ffc70bc40e4cc63680dc87817a2d8f37229ce4d0c36f1e02f551309978", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827056, "uuid": "de15f29b-e808-422c-8459-53b092045559", "comment": "Malware payload", "value": "2afea39c546af925d7aa84757c0ec5dd9b27feb7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827056, "uuid": "b4e813b1-9b3e-42a8-84a6-2a0c568e4896", "comment": "Malware payload", "value": "7c2fd5960da7521e7155776d127c936de1d735e2b4812c705cefa45d49f4aa92468b502d19ef5ede3045b1a6f9481e88", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827056, "uuid": "4967831e-b314-4d56-a13f-8b2c6489a132", "value": "T1F0B24B90CE17BDB40A5A325C8EEDC366DFF490022815C010B8DED31A770699CEA78BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827056, "uuid": "05996e3f-6a9b-4e4d-9881-cb51c189121f", "value": "384:YVpkR2pyC847fVcHAc/HZvMggb1StjxnGeV4xfzDvGMmHSjRDvRcP:Y3jyK7faMLhSxGeV4xfzCARDiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827056, "uuid": "832f18c2-ef9d-4a78-99cf-6b0a3c57f126", "value": 25232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827056, "uuid": "f6ae80fc-7f68-42e0-b898-c1a96c595c28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827056, "uuid": "fee03cc5-dd81-4b22-b5ca-e470b1515819", "value": "26f44b7ddc4fdf3047c8dd65cde2d8ad.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77ec1b5-2319-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773872932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872932, "uuid": "05d5091a-332f-44c0-8d76-2141f4d98312", "comment": "Malware payload", "value": "3751afa60fe67eb782356d0b832b2e81", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872932, "uuid": "cce6d8aa-af89-4a67-a662-b6f4df980993", "comment": "Malware payload", "value": "175f85b026a973bedff1720d01647c1dcc961de4b45f45f6f8bdd00d2f580c6d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872932, "uuid": "9755093c-12af-4269-951c-2ca72fc8a315", "comment": "Malware payload", "value": "bb80e019bdd5fd243eb30819328905dcb3c74f3b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872932, "uuid": "6ea6bbfa-368a-456f-b531-9d3af1d6f58a", "comment": "Malware payload", "value": "c09c70490f7c7041be3a3f91339c2586fc5984c75f66232476aca4c823052d999f7c6400a1d2204c4f17b35339396de3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872932, "uuid": "b0543800-6cbf-4f65-9a8a-2a88e1ae1ca4", "value": "T1ACB58C213686C136D56F03B02A2DD76A52797E703B7744DB63D86A2F1EB09C18632F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872932, "uuid": "f40771d2-645a-4c94-a449-219df1f6e573", "value": "49152:Re7qYaZrf5jSTUial/JrMf+7UVZDEFeBq4vLNgmUESIEjPMN2lv+oBjYjMV3eVoz:rjSTB0q+14veHjPMNanYjMV39gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773872932, "uuid": "615963ac-ead2-4804-819e-f8e4401ce338", "value": 2398208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773872932, "uuid": "da9da46c-8e5f-4876-86ca-b8af262fecea", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872932, "uuid": "a5983de8-2b8a-4da0-a9a5-d56d30a6c108", "value": "configs.app.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ded05e-22bb-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773832279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832279, "uuid": "480e5f58-60cc-4b07-b512-fcaa89771f79", "comment": "Malware payload (ValleyRAT)", "value": "ab4779a150507468073074e1d3b23bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832279, "uuid": "34d43f44-a1b6-4ed2-9522-1a33f964c6bb", "comment": "Malware payload (ValleyRAT)", "value": "17b5930e5e895a576331e8c3734f3d5b23ac21f60e29c062956259a06b86914b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832279, "uuid": "da06ec13-0cbf-4bbf-b58a-2f66d3b6f6b7", "comment": "Malware payload (ValleyRAT)", "value": "c95f61e7f32ef38354af90d6bb91ed9e66d30231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832279, "uuid": "b7e75f99-7791-4cce-b69b-95b40ecd6b4a", "comment": "Malware payload (ValleyRAT)", "value": "df745291debb74e7ef6dd781396b2061b6bc94d53e911f3fd9d1b356ff024f372a8cc113d5d6fa7d376e444f44b193c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832279, "uuid": "8781ed52-a295-4e53-a1f3-4a1306df9c25", "value": "T1E07512DA4EB3CC0BF85D31FC893534279D1E7D880F22F6D38AA4B99981729D29775241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832279, "uuid": "6bbfd865-cd61-4a2a-9669-e9230faab682", "value": "03178db0411f49be0e26499ca1def241", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832279, "uuid": "77e45b13-7d62-48dc-b077-34fd0ff691b9", "value": "49152:ODXQ9ogWoM+v+bVZ/Yt7ED2HD7qaKsMgV6icfgW3EuEEo00U:11/qQpm+00U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773832279, "uuid": "9c29033c-c9fa-49d0-bd7d-89bee9de9255", "value": 1684992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773832279, "uuid": "54da3b25-e79b-4ab7-9b5e-6350ce42944d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832279, "uuid": "7c8688af-5a08-4f0b-a541-0e1b0a8dd801", "value": "2026\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u4eba\u5458\u5185\u90e8\u8c03\u67e5\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ecd8fb-228d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773812796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812796, "uuid": "ad1414b3-8e71-41f7-bae5-8b9a4654d919", "comment": "Malware payload", "value": "86882dd57e9d23454c8437abaf843abd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812796, "uuid": "0f20240e-1d10-4c1f-8ead-a598b06de4cf", "comment": "Malware payload", "value": "193107a516095867fe2bdd8fc7a7d826e9e6b6831b8f4ecff63336cf8fbf58df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812796, "uuid": "3fad877a-4dbd-4c46-9fa3-0c5c5c15ce5c", "comment": "Malware payload", "value": "e991e541055661c396e058687072db53a469d516", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812796, "uuid": "9a3c853a-adb8-42b8-b902-e974f9e151bc", "comment": "Malware payload", "value": "11b95491cfea692df3b3c070b0a36104b048e06ccd45b22499a20db1b5195d29c6ec303b4a2d26bdf76bbf621d37fac7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812796, "uuid": "d487d8d4-9d4c-489d-8bc8-dfcbf6fbfc5b", "value": "T179E56B13B374253EC87A193B98279614983B76E26A9A8C1776EC4C4CCF351903A7F727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812796, "uuid": "c5d657aa-6d66-404a-a646-5cae217a9559", "value": "12c3c96ab78115a7a95f06201a02eb35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812796, "uuid": "c81ebff8-29d1-492b-bd89-94eddb26b384", "value": "49152:okmfhdRnTbhRGScrt1irYLLrIhIShOFOnEzqNCylRAT5eyRQdegm:oA/QnpIylRTyaegm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773812796, "uuid": "34c2a69a-8c5f-4557-83ae-48706bb37056", "value": 3165696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773812796, "uuid": "4624dcc4-2044-42ab-884d-6eb6686e31df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812796, "uuid": "14cadec5-be0b-40e7-bd73-c3915b70221f", "value": "ERPCNN_WFiGP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f65bf5b-22b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773828841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828841, "uuid": "a7829f4f-5d9d-4e64-8981-c4514789a219", "comment": "Malware payload", "value": "8e7367c2e53b843a0f038fad1f757be2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828841, "uuid": "22b0bd3c-0204-41fa-bc88-5c2f65997d9c", "comment": "Malware payload", "value": "19cb78e1c8d0552e2379e61931b4da51a2a614838df30699ea9c6f16b5182985", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828841, "uuid": "63abebfa-a2a0-495f-ac38-8bf0967a3f65", "comment": "Malware payload", "value": "92349e1f6fc701089aebf760de43766b40658985", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828841, "uuid": "cd241130-d087-4fd3-98a0-a4c0ec9345a4", "comment": "Malware payload", "value": "141ea9929e1b56adfe3e00f1ffb763d0211a449eb7fe7f867072dc2551982d94c88a7ccbf9aaec4f13b1dd5d1c405b60", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828841, "uuid": "e7af4897-0b28-40e4-a852-fce7843128be", "value": "T106E17F6037F74710F5BA7E3959BB73558C36BE54EE21C78D1510A00E44B0B60E865F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828841, "uuid": "4bf71355-d8e5-4e69-a65c-656494a39cbe", "value": "24:8d/oKK5JvPJfCii7xoe6rPR5/6snPidNZx8:8lKJHJf4xoe6jR5hPidNZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828841, "uuid": "6ab723de-88f1-44ea-a014-372e20553a09", "value": 7293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828841, "uuid": "bf822e9d-8bda-45b4-a57f-04cb3cf10bd0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828841, "uuid": "cfb0740a-34f5-4ff2-bd21-f4642ce86ed6", "value": "summ.xlsx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf047ef9-230f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773868622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868622, "uuid": "bbd513ea-f267-4b03-902d-6b9f6800decc", "comment": "Malware payload (Mirai)", "value": "69a6676b2ffd99868cae2df750adcea8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868622, "uuid": "33906bff-1520-4a26-9735-f0b4fc4c0361", "comment": "Malware payload (Mirai)", "value": "1a60bef9eacefc3bcc3a032adad5bda22ba85066fa2a46ef2d15fa83fc873918", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868622, "uuid": "bb3f55d8-9481-4455-97eb-702e47e23ef2", "comment": "Malware payload (Mirai)", "value": "c0509a04d21ee1339df68fc1548a6baf069d437e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868622, "uuid": "1fbc02a6-494c-484b-9bc0-0b2b48f1dcd3", "comment": "Malware payload (Mirai)", "value": "a5fd25c9e119ea80ad0c6045b785948e87f2b3789db4eab4fd5c91dc05db2d071a99c86f58216eae366d21d9dcbe9bfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868622, "uuid": "b09447a8-da5b-4054-a382-c6b58bc6060b", "value": "T10EA35ADBF800DD7CF84AD77A84634A0AB131A7914A930B377267FD67BD310A54823E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868622, "uuid": "69f8bc97-1701-4b12-93f5-1fed8b11085c", "value": "1536:a2KPYVujSpDltBd9QakyrRu3Tk/Lx8cyy01ZNGDXu6wmxvPU9H+UmgdIC5j8r:aIlTd9HmDk/Loy01ZoXfwStUmgiC5Ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773868622, "uuid": "daa3687f-294f-403f-b785-9c5c7f823e8b", "value": 98976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773868622, "uuid": "3f862909-e48f-46c5-82ac-6d7f74f8b44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868622, "uuid": "7c72ec35-b2d9-4d42-9f24-575374fcfa6d", "value": "tuxnokill.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f878e234-22a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773823165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823165, "uuid": "2085b719-46f2-4681-9c1f-54ed5c1a46e2", "comment": "Malware payload (Mirai)", "value": "669d5edbe2bf1eeabac933b51bdd1e65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823165, "uuid": "f0333202-8749-4c0e-a4e3-c74e641a9a3c", "comment": "Malware payload (Mirai)", "value": "1a7a29b58ebff5b828407918fc197ed6c299bfd35bd6ae1b57c7ecc924ba59d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823165, "uuid": "1da406b7-6219-4376-87c1-678ccda35693", "comment": "Malware payload (Mirai)", "value": "ee3507390e321da1bb75380c59f3993eac0d859e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823165, "uuid": "fcf5e62e-f9d9-4f69-8158-4dbc19a2bbc9", "comment": "Malware payload (Mirai)", "value": "b50594d582aa948f45a25d61ec49cfa4d7f07cfc483379a9b97ddda90444c2ab602fbed97d60b2f9bd5b4f645cfb7e2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823165, "uuid": "ecad8d26-180e-4c8a-9371-e295b6c11519", "value": "T12E441845BE405E37CBC1667BFFEE42CD332617BCD2EA3202EE055B25369A45A0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823165, "uuid": "6e8b99f4-b78c-4982-9230-7adf79338ff1", "value": "6144:fFULO4pRoolRZmORxYhx/Syq429K2aF/ZgLshYx6WAzvhjTvLnyuQ4GO8T8FGOsd:2LO4pRRR0ORxYhx/Syq429K2aBZgLsho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823165, "uuid": "34ea88e3-ada7-4a92-b8fe-5297a5c22b5b", "value": 254232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823165, "uuid": "88ee87e5-5002-4fd3-a118-d0287765981d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823165, "uuid": "e1789230-74c0-4294-b4c1-f8861c28ea84", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a8b556-22e7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773851135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851135, "uuid": "85032e0a-e933-4e85-9837-782783cb7d4b", "comment": "Malware payload (AsyncRAT)", "value": "b3e19daa9ef01f6e27bfa3ed7e8263f7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851135, "uuid": "2bb1365b-99dd-47d1-9fe6-e85369e5fd4b", "comment": "Malware payload (AsyncRAT)", "value": "1b613d42ccd8fe35782587bd10f517c98ef7bed1d1e629731cc9ff745faa9c67", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851135, "uuid": "6ca664be-239b-4b8e-bd15-4d8173d066dc", "comment": "Malware payload (AsyncRAT)", "value": "4660f606115d4d7031e6f46792942abb090fb1db", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851135, "uuid": "b3a22c86-1fd9-49c3-9084-f67e6b2ed236", "comment": "Malware payload (AsyncRAT)", "value": "0018b400e2a2683db4c63b8573a8a3eb1f376c341875fdc8ce847fdbe6241aa886bcc1b6efb0251797885eace52aa367", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851135, "uuid": "203c59eb-d0e3-406c-acdc-94c8fdaa58b6", "value": "T1E04141862CD661314131D773B21441DAF99E33870F81E5CD3A82808E2F5D2D38BDE9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851135, "uuid": "c5976149-a2a5-4deb-8d07-c14040935f57", "value": "48:1o/BfScAObEpEu+3tj0udzokhinr2aI2TJt2jCdJ1/pHhBaJr:1o/nEGXj2khir2aI2Tv2jC1pHhEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851135, "uuid": "10240b87-578e-4c77-8257-37507063f5f5", "value": 2261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851135, "uuid": "48d49a73-325b-459f-9a0c-2a1b599462a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851135, "uuid": "76a10d3f-119f-49d9-9604-3f567547c03a", "value": "PhM091.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c55d87-22bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773832662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832662, "uuid": "e5b0ca5b-1dca-43a7-a616-6989e478bfa7", "comment": "Malware payload (Gh0stRAT)", "value": "07b96ce936415ef148024c77d964052d", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832662, "uuid": "d1a00fd4-49d0-4c08-9cf0-5150d84090d6", "comment": "Malware payload (Gh0stRAT)", "value": "1c38dde07bc7b0367f7bc0386d7f3e2b1114eb70e83f7224efc0b2b2aac09eee", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832662, "uuid": "4fafcdfe-ff5b-429a-b94e-7c21ef68fad5", "comment": "Malware payload (Gh0stRAT)", "value": "847a46ceb8829cd072df66bcff54695c47e824d2", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832662, "uuid": "c74a6f00-d659-4633-8b9a-46569613fa77", "comment": "Malware payload (Gh0stRAT)", "value": "8bb8e7fc6ae4078983d5bef8933c6997df62e2d925ad8c6222619c91d8ab8adb8e928dba0cb7dfee1321399c036777c5", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832662, "uuid": "9ff2b6a6-8f2e-4cab-ab15-ebefe85765ab", "value": "T1DC473321A2CBC532D95E0077ED29FE5E04B8BEA30B3001DBB3E47DAE98B48C15675756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832662, "uuid": "2ffe68fc-bed7-4970-969b-10a580409172", "value": "786432:Syg/EbvG5fvljWr++JBXZnGoxSGbMhfJC+xhR5:SDsCtO3dGCv41JC+xhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773832662, "uuid": "d1a67da6-34d8-4d4c-8373-401f22bc43e3", "value": 26329600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773832662, "uuid": "ecefe811-f541-4fee-8253-34e8a239a4b1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832662, "uuid": "155cdb66-d6a9-49b5-82e6-4bcf3c2d79a9", "value": "Google.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab7505f-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826525, "uuid": "d0a4860d-2d14-46b9-8919-107fa12d4705", "comment": "Malware payload", "value": "6287d747923b26c84005a7ddaafd7015", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826525, "uuid": "03c8a700-6763-4919-8ccc-7b65738ca8b4", "comment": "Malware payload", "value": "1cddc381f4d71aa44ad63c7c5f0a8e6a4109b6ad5612969f8a4f765694f2bb39", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826525, "uuid": "470f1efa-9c5d-42b1-91a4-dd371d137240", "comment": "Malware payload", "value": "912ee60e819e1cd9a17af25f4c120f043d57b68e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826525, "uuid": "b838e37d-009d-4e36-8786-3f2e455ab7ef", "comment": "Malware payload", "value": "3e19cf44f9fcaa93b2dddf4650588a2957624ad879e6520bc7fc21c04bc71951803df33ef9759f67c056d9314ff08b25", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826525, "uuid": "29ddbe4c-e2cb-4f78-acfe-f447acdf6162", "value": "T112F4231D70999AC7E0A27E344CC4648E284DFC122F1FD1977A9DBB3B3435A6AC25236C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826525, "uuid": "6dc70c66-a5d5-4147-9360-69c0f2be073c", "value": "12288:a5gZJmp+f9eNzw/nTv+jO+jdQST5tfzpJSBHOn3PKe979w4XnzgNm+ZohbZw3:mgZUpaeJwfTmfVHTR3zhTXnzgI+Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826525, "uuid": "28a958c1-eb2a-4ec3-bb09-f0589ef9d618", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826525, "uuid": "5187c0a3-a0a1-4984-a897-df76a6e023bd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826525, "uuid": "dfd80ec3-7fd9-4861-85cd-6e7cabab44b4", "value": "6287d747923b26c84005a7ddaafd7015.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b79f878-22ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773838847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838847, "uuid": "50b51f60-d98b-48e8-bf26-fcc1b86e282c", "comment": "Malware payload", "value": "d810b43860920b8ec0775e396c9e0448", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com-venomscript", "colour": "#E5C5D3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838847, "uuid": "9fa0ccab-5615-48e6-bfeb-23cc33c882f3", "comment": "Malware payload", "value": "1ceab50ed3e620490b2434b52a720e69b5f720cc545557ce1b7c5ccfad397806", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com-venomscript", "colour": "#E5C5D3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838847, "uuid": "5b229f7d-34a2-404b-a531-912e807b5af1", "comment": "Malware payload", "value": "2d6f3267f46db7b686197c280537e10bda41b092", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com-venomscript", "colour": "#E5C5D3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838847, "uuid": "5a5d801b-181c-4abd-87ea-12a5b6866150", "comment": "Malware payload", "value": "842afbaf3b33af19ffe3b91375fb146d336e507cadce2851caa27b84e9f42f4177d9611b99869b6e46e6dacd65505f1a", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com-venomscript", "colour": "#E5C5D3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838847, "uuid": "7a4b58a0-1f3a-46a9-bb5b-4905ed7b7ecf", "value": "T12CE54B13B288663ED0AB0A37CC369640593B76646A379C176BE40D4C4F3AE517D2EBC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838847, "uuid": "b9f2b45a-94fe-4b1d-99ca-52107bc4bca6", "value": "94501dbaa1b3c5f4854e93b5848f4994", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838847, "uuid": "f6f6b8c0-8b0c-4411-8e6a-01d6ea8485dc", "value": "49152:4cQGDZ5luz/d8SxFIEXm3GHcwZufQCa/QuS/um9ljG6hR:vlEewZufQ5/QuS4GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773838847, "uuid": "9b12cf59-09d8-47cd-bed5-7c95eb107280", "value": 3307720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773838847, "uuid": "b33c07e5-1992-47d7-8e91-3dbcab9a0f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838847, "uuid": "81c58a38-7313-4017-b747-b01ad1b899bc", "value": "1ceab50ed3e620490b2434b52a720e69b5f720cc545557ce1b7c5ccfad397806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b53ddec-22c8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773838041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838041, "uuid": "90ee2ebe-9a73-467a-82ca-7726b6b16723", "comment": "Malware payload (AgentTesla)", "value": "2d3233e3158010659b9bcedeb5a7bd91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838041, "uuid": "7f84985f-eca7-4333-8737-d84d4ae7056c", "comment": "Malware payload (AgentTesla)", "value": "1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838041, "uuid": "ffab906b-c2c2-4d5d-8c36-263b7b97a08f", "comment": "Malware payload (AgentTesla)", "value": "dcf629e3a6df180a90e30ef049ae94d00fd6235e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838041, "uuid": "a96a5233-fac5-4221-9db1-9795baf2cc99", "comment": "Malware payload (AgentTesla)", "value": "72deaf22e79674996caa6ae5bf9c284d65419dc1cfef341206fc36eb54706905f2e9ddab4636f564bf49d67fd77d708c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838041, "uuid": "f70699a0-2d8e-490d-af54-0945c1e077e8", "value": "T19645BF027391C062FFAB92734B5AF6115BBC79260123AA1F13981D79FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838041, "uuid": "0b8a4b73-6737-4ec8-8208-14602aeb921c", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838041, "uuid": "5b172177-7e3d-402f-9b3f-22ef2e1c4dba", "value": "24576:U5EmXFtKaL4/oFe5T9yyXYfP1ijXdacRReQe7kLW1/uYf0dDJsY5:UPVt/LZeJbInQRacRTh+eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773838041, "uuid": "a26fe2cc-0d1b-41a8-b943-acc01ced8b78", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773838041, "uuid": "91798102-881a-46ed-85a8-47267797fb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838041, "uuid": "d9f7b40d-4b8f-4783-8442-2963383946c0", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596a29cb-2275-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773802283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802283, "uuid": "ff84000b-d10b-433a-8348-e2ce6420b67a", "comment": "Malware payload", "value": "ca1c426871cb93f3ff557f82ff470ee9", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802283, "uuid": "bf7d7fbb-4ba4-4858-8b7a-688b8fc1e030", "comment": "Malware payload", "value": "1d4a3cf811b18a04d46d150ae01264dfcaaaf902c435f46b2add18600328490f", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802283, "uuid": "c390af67-0d66-4eee-89f0-56eba3618421", "comment": "Malware payload", "value": "0245088e6b18a2fe3daadbf0c00cdf4e4efdc076", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802283, "uuid": "a73a6df1-cba6-4945-9da7-4f2f7644b6a3", "comment": "Malware payload", "value": "8762869e255f2959668a8d3be3a59e1aaa85e478998947445390d6df9ae946ebf247f3ea070edffc29805b8386aad251", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802283, "uuid": "7ba1b381-abe2-4d54-bde5-c407cd3a31af", "value": "T1B497D08AD20CD535D4CEF17DBE7E0A9273244D6C86D69916B81CB124FBEB0F016B3692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802283, "uuid": "2be275a6-d645-4136-b271-84e29921e87b", "value": "393216:jlBWAss8fiE3PIdEcX3u3NKK6peKWExZoFVprAznKhJ9qE5r7grTfdB:jnGQq3Nn6CQAVprAzn6+ERaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773802283, "uuid": "10216028-96be-4e6d-b83e-4e9507755a1a", "value": 43413419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773802283, "uuid": "1c2fc8fa-ad54-4bec-9b1e-baecc161e963", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802283, "uuid": "6bff4ae0-3b97-4d9d-b11b-1e01df1d31cd", "value": "com.selfie.camera.androidcam_8.1.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea956c57-22a5-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773823142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823142, "uuid": "07097432-e498-4be6-8028-dbabc2eed3d6", "comment": "Malware payload (XWorm)", "value": "54173c1d8fd697fb683e2ed32c62039f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823142, "uuid": "0c222e73-669f-4ae7-bf67-e459e88a5b5f", "comment": "Malware payload (XWorm)", "value": "20653a298c5d681cc4fe764442a2cc569914debc5e18bdfc26d6b4ff926c1019", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823142, "uuid": "43fc2721-037b-4bf8-9529-ced4254a13e6", "comment": "Malware payload (XWorm)", "value": "0e2e54e2a4d344e2cb2c3b23062964520aaa6019", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823142, "uuid": "006abe23-1959-4182-9ac2-bce4fdb42967", "comment": "Malware payload (XWorm)", "value": "44b89a7d9061a99651bddcb5e65935f387aa7165c95bf739f5f46d6f42f86bec7e03f07d64fb106c0f8eae60d5219dd1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823142, "uuid": "a6a210ee-5a37-4e07-a204-c787a68befc7", "value": "T1EAE0A3144336210E49558597480D91DAD69DE2C813377AF769C46C804D401CA795F15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823142, "uuid": "2d45d67b-e46a-4981-932b-899b26870972", "value": "12:wbYVJ4JFilo984CXLgyaIS1PKC2ALFyGHDfhHXQ1MnGHXbk1N:wq4jiloEXLw1PKC2kFHDV9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823142, "uuid": "401edc9a-08c5-41c1-9489-59281aad964e", "value": 421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823142, "uuid": "2545c79f-792b-4ff7-b1aa-270af6a976a4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823142, "uuid": "dc0ae871-c38b-4b51-b9a1-1a02e703d9c1", "value": "MEGO-BAT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c5c700-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827030, "uuid": "503a1567-8ff2-4933-b0d9-47cb76c5bc7b", "comment": "Malware payload", "value": "c9635e17980cac26abaf2ec73090d453", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827030, "uuid": "efa17972-66ea-43b1-abfc-2aa50fc2d6b7", "comment": "Malware payload", "value": "212635ec756f8a9e07052d45591b3279f5b789f411c9a0f7ff72fa456066209a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827030, "uuid": "17d9237b-d1e1-4646-ba68-b550a68e4749", "comment": "Malware payload", "value": "6d52802c8b0efa25f0d9060ca95a1bddbc110a4e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827030, "uuid": "7570de90-242b-4729-b12a-84e5cf5db232", "comment": "Malware payload", "value": "3d079e2ff13e91069530927329e3c8c42f6790dd57f8223369f31f7ec1afa339e8777808f567b3d6fe55f2422bc5ee88", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827030, "uuid": "94b57b3a-7975-4191-a29b-29dd9580a61b", "value": "T1E0F230616DF408DB5D7C443465C9AF324C7DF6AD122C1A056B2238BC8D9B7C2A1EE72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827030, "uuid": "2b9a2af0-eb45-4ef5-9ce2-5cf9342a94b6", "value": "192:v8S+FCUZMO/uYDRtr7ErnBHxgxI2uGCWMcmSWQAGuRIEoTWHqVdnY3DPRzTm2:kZFnP26PrQlR11kPmScVRIErKVaRzTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827030, "uuid": "20c1a177-a942-4f74-a921-b01f3943c984", "value": 34359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827030, "uuid": "0563eb1e-e399-4afb-a260-086d116392ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827030, "uuid": "4b7cb01b-a531-4921-9e6f-64c6af732105", "value": "c9635e17980cac26abaf2ec73090d453.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1d0963-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773826470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826470, "uuid": "23c0d8d7-757d-4e8f-834d-2003aa022b59", "comment": "Malware payload (a310Logger)", "value": "00e106f5e361ad6b1bb64acc66cdf776", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826470, "uuid": "a745f58d-b43c-4957-bc79-b322c5255e63", "comment": "Malware payload (a310Logger)", "value": "22299bc617e8c48c64efe15d457304fc4f29591b683379c04cabd3f94dcaeddb", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826470, "uuid": "4da6b037-cbd6-46eb-98fe-fb816a21594e", "comment": "Malware payload (a310Logger)", "value": "de73d65016a86f9a37242fd354fb13ff3856df50", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826470, "uuid": "65f140cf-ae41-4a72-b5b7-bb90bc8e42d5", "comment": "Malware payload (a310Logger)", "value": "de489287085b1dbee03b422526bd530a3e93398acf9e0c1c26c49e294329f4dc114052a0fe376e5b2b38b0152e89fd5e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826470, "uuid": "7df7c119-3d1d-4207-b37b-336eff3462be", "value": "T15BC5CF15FAC129496F8CCB0020F9622E22657EADB245DDAC773F6E7053770CC5ED98A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826470, "uuid": "7ce761be-7b9f-45b8-8693-0d44a99495ac", "value": "24576:pivOomWHpfE/Rr+s88VYIMXO8Zjc+XlsKB/9qC5knnBBI/qqIERGB6SRt1gL6uuD:piLJDHhXSRturNfhH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826470, "uuid": "824e9f28-f617-4ca5-a99d-37bc3fc4ea4f", "value": 2601475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826470, "uuid": "77d97632-1db3-461a-91b7-c2d5baf03e26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826470, "uuid": "0dced88c-da22-4f2e-8ccb-3c6867372836", "value": "00e106f5e361ad6b1bb64acc66cdf776.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b06028-22cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773839450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839450, "uuid": "aad2ade2-c6bf-4666-8046-17543e182c1a", "comment": "Malware payload", "value": "2d8e2321183f76310fd642ede16a47b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839450, "uuid": "4c3a8a19-7eaa-4a86-a489-7eb3083688c9", "comment": "Malware payload", "value": "234dfbb04bd402cc0162858d2b31c7f179966f24711edc29e905b23b02f55aae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839450, "uuid": "10bbd3ec-7cb0-46e4-a2ce-83524a6b6187", "comment": "Malware payload", "value": "76d67bc1f242fc2a1a921062dc87c59ad785599a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839450, "uuid": "d3451260-b981-4770-a9a1-175ada27dc77", "comment": "Malware payload", "value": "18bd0a36c4d5d015c1043ff657a8504e51dbacbc0cab60e1f11dd0e62347e38ca103105c13a0a7f2736266338055919a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839450, "uuid": "39c98314-040b-42bf-a57c-2ce26885b8b6", "value": "T171B249D0C94B7EF40A9A6604AEDED268CFF441023821D060789EE7057716A9CEB787DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839450, "uuid": "1d57b75d-e4d8-4dbe-bbc5-ca2c81411c9a", "value": "384:YVpIj2gyC847fx1EfwX/Hjl4yfQ72VitVanrwxfzDviUeMqldIfN:Y3AyK7fxv4qQaVQarwxfzrehrI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773839450, "uuid": "b2c67bea-b759-4194-9a7d-0edfcd538c16", "value": 25178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773839450, "uuid": "ca288202-ce65-42ae-b887-e1eb436099ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839450, "uuid": "b3758ae6-3dea-4622-af94-9d1a40cdc54d", "value": "University of Delhi Form\u00b7pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7860d7-22a7-11f1-a769-42010a9c0008", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1773823821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823821, "uuid": "8de4f0a7-6895-4a3b-8f1d-1d02f802f5ff", "comment": "Malware payload (CaminhoLoader)", "value": "6789cccb5eb39241dec44c139841b835", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823821, "uuid": "f917f060-a962-4de8-9dff-fc175507cae4", "comment": "Malware payload (CaminhoLoader)", "value": "23dd7e5e971e8851ddfdb3fb45fcd6b9227e375cc6b293e6e98ba95912cf263b", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823821, "uuid": "017f6d5b-4c50-48f8-a7d6-ede553fc8fbd", "comment": "Malware payload (CaminhoLoader)", "value": "66586573fba42b2dace24b17d3bae1de7e9a7363", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823821, "uuid": "933100d1-a0f2-4e0a-8f0e-0c1c58cf06fd", "comment": "Malware payload (CaminhoLoader)", "value": "edcd2a02ebc16717b8da06780ac8afce0fffdae28a2bccd004ab85abcb0317ef351a1b958bf6f6872b9d35d1b187964c", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823821, "uuid": "514026f1-856b-48f3-a285-85793dc0cb7c", "value": "T10E951178E5AC5C93C94C714C2AD64A15E25AE41220E19F31D38EBE82093F6B72FBF5D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823821, "uuid": "d46a784d-a31b-446d-ae3f-094015a29363", "value": "192:aggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggX:skMruIwGsZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823821, "uuid": "624fb9d7-4212-4e01-ab5c-3619a7e47991", "value": 2054133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823821, "uuid": "f17c1c9f-4395-41d5-806a-9b27bc30b465", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823821, "uuid": "d8941111-7e56-4ca9-8633-43e711c5a6c6", "value": "Plugin_Planilha.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebd5c31-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800976, "uuid": "1d4ac9c9-97b9-4e8a-b4dc-d99596fe7f01", "comment": "Malware payload (Mirai)", "value": "310784f0a99ca1549775c67cbb4fce60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800976, "uuid": "90a80e7d-687d-4d4d-9212-5becbec5327d", "comment": "Malware payload (Mirai)", "value": "2570bc80f70fd44e3a5e2bd6684766b45bf558d10b227c0f80bbeb197240bea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800976, "uuid": "ec233bb9-7bba-423a-aaee-58ae2ce33715", "comment": "Malware payload (Mirai)", "value": "2c1a09dc6391a746165b102becc672583d607ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800976, "uuid": "fe07e130-cd3a-4093-a6ee-1500f52e2ecc", "comment": "Malware payload (Mirai)", "value": "78030122da829623ce0913d8171c96226ab4c07a76d43a6d287728adc3cc3aeee23a26659c833d8406f36887e3061ac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800976, "uuid": "e014679d-4139-46fc-9ccc-cf3687be787b", "value": "T1CD330994BC81AA17CAC156B7FB4E43C97B166398E2DD3303DD26AF61378B92B0D67101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800976, "uuid": "594d050d-8915-4083-bef0-20d100ccac6c", "value": "768:Fe5SwCbI28rt1+aL4s/nvkaOsdMthsSaeYby2HG51yMvwEgE0I:IQw8M5L9fvdYtSUQy2m5wMgE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800976, "uuid": "b95b6917-29a9-4feb-90b4-5bd0a4b8dad7", "value": 50552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800976, "uuid": "f2f9c7ea-cbe9-4389-9662-55faf3171cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800976, "uuid": "6aca2139-0471-4810-b365-b17e210bc251", "value": "dontcrynow.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d84ac5-22ab-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1773825355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825355, "uuid": "677d82b8-69e2-4a35-aaf8-e7cbfd6a162f", "comment": "Malware payload (GCleaner)", "value": "b821882af0b80996c5a5e5ff6e29ff27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825355, "uuid": "5a3928aa-5bee-4d54-b93a-a7e22c234f15", "comment": "Malware payload (GCleaner)", "value": "2686a649c29df76f437b54c815f359d0652155a4657aaf8479b6398d8cfc78aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825355, "uuid": "21e45c02-bf18-4d66-81be-8af54f35f5e7", "comment": "Malware payload (GCleaner)", "value": "176af50d83a368f1773a70cd3611556cd5f573e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825355, "uuid": "cc3acf18-aaa8-4c94-84c7-87a872bd08cd", "comment": "Malware payload (GCleaner)", "value": "b865b2681d8e958d862a4b943bfc1e8d366d81920373234778eb52615bad884c6563608b85593c4290a0c16828d862bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825355, "uuid": "264c1ff8-4eea-4613-b9be-3e7cc38c2d37", "value": "T1F5626BB388606C06DE1BDD75F4C9C92BFEB672816DC0C2D72149C8508B90BC77B9E5A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825355, "uuid": "1a7ffeb7-5b96-48a8-b835-ab60fc679f14", "value": "e13d1ae0a2d96c4ad22442e33bfbb444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825355, "uuid": "572d134f-b7b5-40c3-96c9-4f0a24dc34be", "value": "192:kzHiDbnPb7MM6epPqid3qbdULc8pq8RuwdmL4pUQrNy5hTxtT/:kzHiHD5d3qb+y8RbmL4nNy5hTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825355, "uuid": "f6702df0-caaa-4ce5-8d9a-3f88c8d537f0", "value": 15000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825355, "uuid": "19144e57-460f-468a-97d6-0658501c41e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825355, "uuid": "3e41de84-cacc-43e4-a72c-7c89ee1ff27b", "value": "b821882af0b80996c5a5e5ff6e29ff27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d91a00-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800983, "uuid": "f76e117b-4ce0-413d-84f2-eb4dd5a2ca20", "comment": "Malware payload (Mirai)", "value": "e9be35e633acfd3ec475fbdb5bf70c0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800983, "uuid": "6a283d67-4998-45d2-944f-c258177182b2", "comment": "Malware payload (Mirai)", "value": "27278538affd35ba966fd23c1f380fd55d36b33a6741d0f03655dae0ef92d689", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800983, "uuid": "706b34eb-d0e8-4cda-af47-b20d37299169", "comment": "Malware payload (Mirai)", "value": "7947717bdeb4a33b9db6f1f1acea51f446dc5ce7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800983, "uuid": "2e002232-6848-4d7a-897d-f65ccecbb553", "comment": "Malware payload (Mirai)", "value": "73819afa1a571bf804e52ef4105b44d2cd7fa9cd27fbad1805dc3eb0c9d13de22d02d52bbcca27a219e54d163ba140bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800983, "uuid": "76e93bba-0ed1-410f-8598-b28de7f4edab", "value": "T1BB331994B981AA13CAC146B7FB4E43CD7B161398E2DE7303DD26AF51378B92B0D6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800983, "uuid": "9afc0d33-de30-41f1-8ad1-f162ca89633b", "value": "768:yBhpaISbID8r91+KboM0Xv02OkxMZJEiKBgry57RVGQ92wWB2vlE0I:6wIpcJbtCvZMZqrIy5tk9B2vlE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800983, "uuid": "057010c2-3644-43e6-8ac1-16ff56ca6ac2", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800983, "uuid": "79ed2282-87a3-4a3c-90b1-73b01de353e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800983, "uuid": "b802ca6e-3810-4986-8030-493ed8c96e31", "value": "dontcrynow.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b447bd23-22c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773838083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838083, "uuid": "df322bfd-7c66-4dc4-befa-ac0e03fb7b11", "comment": "Malware payload", "value": "3895302964bcb46729c61f82a798ef96", "object_relation": "md5", "Tag": [ { "name": "46-30-188-99", "colour": "#15B53F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838083, "uuid": "67e2d94b-8340-4165-ac11-58707a2888b3", "comment": "Malware payload", "value": "27a5d818f690b4c0b1679381ee48ffafb8d3b4ad6247797c32698bd6992a224f", "object_relation": "sha256", "Tag": [ { "name": "46-30-188-99", "colour": "#15B53F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838083, "uuid": "3b62d259-e168-4fd2-bbf5-a7d95c6a67b9", "comment": "Malware payload", "value": "f87af555b38949553782281ffc9251c093f0c089", "object_relation": "sha1", "Tag": [ { "name": "46-30-188-99", "colour": "#15B53F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838083, "uuid": "cb094aef-b606-47df-a98d-6b489eb1e1a8", "comment": "Malware payload", "value": "729a0b4ccce5fc79a020801e7e7879ed95c09c3b80e93befc98c0d2c8eb62ea57086b33302c87889835e505db1dc29ba", "object_relation": "sha3-384", "Tag": [ { "name": "46-30-188-99", "colour": "#15B53F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838083, "uuid": "5b93c9c9-663a-40fb-9f2f-cb2864dadd47", "value": "T118D45B5239D5149AC13782F2CF93E1749713FC781DA4852BA2CD2E165F0AEA12D23EF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838083, "uuid": "c2c777bf-b4fa-415c-b87f-999f2653fb61", "value": "cc17bcc7fe575a59b90e88841fe76dbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838083, "uuid": "b90ef2f6-249b-45f8-a892-1d6dabc9e487", "value": "6144:l7RyhwDsJo2xj8niAhoDsAiv5pTGBNN9hR5wKHqj6f3rdJhnt/eGWv4r4BMqjexv:NR6JoBiUXTsN9hMjsLeJMqj4zWYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773838083, "uuid": "f3680815-6268-45b5-a0af-fc0d81006b26", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773838083, "uuid": "1de3f6f7-9e27-4b4b-b7fc-8bebe4dc0580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838083, "uuid": "0781d6f1-6007-419f-a7dc-d56496565cc4", "value": "dbconfig.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c60e2d5-2291-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773814287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814287, "uuid": "b1dfcbf8-6d27-419f-a36d-36447509d6e2", "comment": "Malware payload (Vidar)", "value": "9cec04e4fb8da114546b68d1bb54cf91", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814287, "uuid": "1f759121-67a7-44a6-b2ab-f5e999cad5cd", "comment": "Malware payload (Vidar)", "value": "27ae61f53faa47aad66940145cf392f5a8db1ea2f5bee85c1223ca495b9da552", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814287, "uuid": "251e745b-3eff-4c0f-ac93-9925eb95028c", "comment": "Malware payload (Vidar)", "value": "ef5a33f587c5869aca76c4f7bb4a60849222f793", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814287, "uuid": "7e16c825-bf51-42d3-83ec-d881319de461", "comment": "Malware payload (Vidar)", "value": "970d80637ac93611cae2f597fa1326d703053c757dee6f149a61df5752fa6d743b561b2ef86414df7b246445ac9d4936", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814287, "uuid": "587da3d0-a873-46b5-bad4-44651d5a3fdc", "value": "T173A58C07BCD144BAD46A973689B652A27A75F8090B3233D32F80B7783FB67D05A39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814287, "uuid": "ea6312e9-97a8-4620-a82a-2626bd9ffa27", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814287, "uuid": "fb633ea8-a341-428a-89ea-f444b9d4bb2e", "value": "24576:wtqeInktYPY6Gm0dqjxtSSyEIhZ8dAouX7tNi8VuGiWPK61l:wtQnktB3mCwnylhZ8xmBNi8VJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773814287, "uuid": "fcb59e42-bb84-41fb-a4e7-87d51edff26a", "value": 2179584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773814287, "uuid": "e36054c4-bdc6-4bbb-a46e-cd16deed72de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814287, "uuid": "2e601efd-1ea4-485d-aa11-f6aaef4e84a5", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db40fa9a-2307-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773865207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865207, "uuid": "fa66c901-0a01-4594-9b45-457d6c466cc7", "comment": "Malware payload (RemcosRAT)", "value": "6155f7a4fe87e36e433b1059f44aa4aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865207, "uuid": "bd9a1dae-5fc8-4bc9-b719-c879ee872ef0", "comment": "Malware payload (RemcosRAT)", "value": "2808f2134ab9830def2aea030248c5cc7c353c409ef7fe5c34292ca6eb490039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865207, "uuid": "eb948db6-710b-4a8c-b154-f075c6702f99", "comment": "Malware payload (RemcosRAT)", "value": "28b01fccf002670efac71e14b9784b7aa1488e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865207, "uuid": "4079eb7a-2882-4da0-a9f9-42227962f90b", "comment": "Malware payload (RemcosRAT)", "value": "61e8388b26f0e297188811d09f8c1c92e42bdfc990751b45561fade7ef9e1d3a1692781b3ad3acb267318eeb2f02831a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865207, "uuid": "38d51720-e9ae-4371-ae08-0b6cefe67127", "value": "T1D5B4AE01B6D2C1B2D57654300D26E775DEBCBD202836997BA3DA0D57FD70180AB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865207, "uuid": "f17698b6-35e2-4521-990b-b3afd9a7747d", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865207, "uuid": "663f6297-45d5-4858-821f-2bdacf822169", "value": "12288:FT1tInGFOPvn+ySVx6puG8pDxR+sPZQFd:FT1tIncO3s6puG8ZxRtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773865207, "uuid": "45a64f54-48b6-46e2-b036-28c17fb2cc8b", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773865207, "uuid": "b2618d8a-bcc5-413f-9d06-2cb84a9c7454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865207, "uuid": "a5cee5c0-bbef-4e65-b11c-6ec4be9a5548", "value": "2808f2134ab9830def2aea030248c5cc7c353c409ef7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f8ffd3-2313-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773870104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870104, "uuid": "6177122f-b5a8-4f95-9e74-c4ceff74a8a5", "comment": "Malware payload (RemcosRAT)", "value": "443ee8c4127b5e3c80103ee85df04df2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870104, "uuid": "2a551f45-e2ba-42d3-98f1-5bfbdc7d8f9b", "comment": "Malware payload (RemcosRAT)", "value": "2828d9017bed60749cdc77ab4661ab2025c7959d1b2505bfcaefbcaadfcd49d4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870104, "uuid": "1f0070ad-78a2-404e-ae6b-f1b1bb2abcc3", "comment": "Malware payload (RemcosRAT)", "value": "3a3b8ebebddb5e916c86411b694e9ff88d5409c4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870104, "uuid": "555808cd-8ac4-4b88-b771-ba4b01f6f5b5", "comment": "Malware payload (RemcosRAT)", "value": "9279b1f7dde75788e2eca059e6c1cde321cb6b94d65f09d4e8f83ac70ba7700c324f36ea40883ed1588bd357a0aaa495", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870104, "uuid": "9a7edbae-04e6-455b-bb63-57912795919c", "value": "T1C2619E4243A012DECF2269D1223EBD09076DD2AE02D375FD93959763813E59A2F78878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870104, "uuid": "4b98ff87-b3e8-46df-a3da-c1f25c43a674", "value": "48:c6QIeubpJxon1QLVK+LzKEHcmN8aQ5VAgpPR/Z8RrtQW5F/gVPRD+8c2WwzYGowS:cGntox+HPNVSB138Rrtwxlk2WbTOz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870104, "uuid": "b96ce8f8-608c-4ad9-b336-3fa6e2825076", "value": 3366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870104, "uuid": "d79c3510-c4cf-4ec8-aac3-7a39266d502a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870104, "uuid": "74a9e174-fc30-473d-adcd-5769f6e0bee9", "value": "wishlist87231.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b706f0e7-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826492, "uuid": "56d331a4-e986-4cbb-aa4e-c289b1e1ef67", "comment": "Malware payload", "value": "b0bebac94350c9526ba3ac30cbf8959d", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826492, "uuid": "49bb93ac-3098-4bac-852e-642e61cf7583", "comment": "Malware payload", "value": "289f6acd63da45b721c13db55976bcf931a06405c40123a09dbdc928a2e6692a", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826492, "uuid": "7258e01a-a546-4d64-86af-f45e1ec7d8ee", "comment": "Malware payload", "value": "9083a000585ec80e14c800c9dbaa66175056fa12", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826492, "uuid": "97b34453-7f6f-4126-ab4c-5cc57a38aa19", "comment": "Malware payload", "value": "c046e673affa6141a3d662b87bbe4be657edbaa3ea0b7da0bac30cf75b13afd796341a317c3a2cc0a9e52d1ffce48dd4", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826492, "uuid": "a9c35252-8f8d-4082-b84e-bb132cc498ae", "value": "T11FC42309F1A0AE9FC19374384C84A882558CFC260B6FE097BE547B7E3D7A725CA1152E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826492, "uuid": "cddfde40-e44d-4b03-9956-a4c92bd781fd", "value": "12288:F2GrNzw/nThP83+2jdQeM2tsmnoeh2BCLcEyEDqV:g2JwfTx83+q1M21fh2BkcEyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826492, "uuid": "82db804d-a6a6-46c5-ace9-4cc6f41cc615", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826492, "uuid": "bb317d1c-0264-436f-8c1d-e8ceff3e3039", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826492, "uuid": "4f5c8622-0c73-489a-88cb-ec01cb3a2c4c", "value": "b0bebac94350c9526ba3ac30cbf8959d.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f124467-22d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773844437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844437, "uuid": "811b6042-2d02-499f-b04a-f9ca0c5fe457", "comment": "Malware payload", "value": "2cdfff529eb78535e9af21c178b70e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844437, "uuid": "e8d30bb1-9282-481b-9fac-bf46c95789a2", "comment": "Malware payload", "value": "28c030fbd1af80241b11376cf9c113082afb5d3dc60700cda14766eec041f759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844437, "uuid": "1860d89c-3be9-4ca7-ba63-50397905af64", "comment": "Malware payload", "value": "f339ce15dd8c54a4d042013b3d380a54027787ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844437, "uuid": "cfeabbb2-2e8e-460a-a6d6-9a7b33ddbcfe", "comment": "Malware payload", "value": "b32254b4b0f729889b108ae2a88fc7be2c207337177be7e56e285900ee434803e006f97639b9054d17755102820f6140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844437, "uuid": "c1f89339-6fb3-4d70-8193-a6ea384070b9", "value": "T11A853337531A2A5DC25EEF72BE61F4B1D1632C2CBCCC3B151E0A924245BE8C53D94B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844437, "uuid": "b42b1b20-4c37-473b-bb05-b669061c6cbe", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844437, "uuid": "4fdc70b9-9615-4257-8d77-e6fa60714198", "value": "49152:62+IxW6t3rGwrV4vHNXiCoyA012K1Vn01gSkwojFet:6YtbLrk4CoTWPfVXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844437, "uuid": "eee3ce7b-8210-4ccc-bcca-035c57d59f01", "value": 1867264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844437, "uuid": "5b2f3f5b-da2f-460c-948c-8ad689a402a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844437, "uuid": "dac1fee8-3fdd-412f-932e-00e478734346", "value": "e896520a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd2d309-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827040, "uuid": "fe8668ec-c6b9-4a36-bfa1-8aa7b37700ac", "comment": "Malware payload (Formbook)", "value": "219316c809287e2cab1a331d1fd5db69", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827040, "uuid": "66afb524-0b0e-40b7-ad58-d37c91e822c0", "comment": "Malware payload (Formbook)", "value": "299f7111fde3f92a1bffa60d3bd010b1d0c13be3fcf98dcc60a14784fc514589", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827040, "uuid": "d3a272e7-1dcd-4d09-acb6-832ac770535d", "comment": "Malware payload (Formbook)", "value": "8426f47539ed56b28860b98be884a921f6cb9f96", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827040, "uuid": "556d24fb-b832-4902-85cc-47672bed4de1", "comment": "Malware payload (Formbook)", "value": "5a50e43df5b0f9c87f1b17834042999bc74e592c860431fbfa64e03d610fd63b7294beba1cfd7d16dded9a0c96288e5d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827040, "uuid": "e625a3ca-05f1-4a6c-b9d9-604bee30d787", "value": "T1C7B24BE4CD4B6EF80A6A2A14CEDEC160DFF481132865C450B88ED3597B12A9CE3797D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827040, "uuid": "0b31c105-142d-4dc9-a1dd-08bde41fa7ff", "value": "384:YVp4G21yC847fW7hvipgP6Y1K/HPiue4TjOud3tbcn++xfzDviQbG1H/Oc:Y3IyK7fW7kiutjZd9c++xfz/q12c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827040, "uuid": "d7e39663-ec4b-4bef-868f-67cbce0c7742", "value": 25120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827040, "uuid": "152bee0e-e321-478c-b77d-4a4678637818", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827040, "uuid": "49378610-69cd-473f-98f6-2b95b49b6f18", "value": "219316c809287e2cab1a331d1fd5db69.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ca53b4-22ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773840777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840777, "uuid": "16b1c6a0-2a43-4311-9013-5d096c9d6a37", "comment": "Malware payload", "value": "e81f5a72053c4ce125891b1e220adeab", "object_relation": "md5", "Tag": [ { "name": "151-243-109-239", "colour": "#303BEB", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840777, "uuid": "96064a68-223f-4024-a227-f5ce50c07e76", "comment": "Malware payload", "value": "29ff32f98ccdb2450f2b8acb4165f89a6297ca8598716c8403899fc54c499d33", "object_relation": "sha256", "Tag": [ { "name": "151-243-109-239", "colour": "#303BEB", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840777, "uuid": "415c1abc-6739-488b-bc19-4c4b6f629374", "comment": "Malware payload", "value": "75384f4a3393c8815b78c6212c042b30982dc6fc", "object_relation": "sha1", "Tag": [ { "name": "151-243-109-239", "colour": "#303BEB", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840777, "uuid": "4eef6398-5bf6-4d6f-972c-6abf9883cf6a", "comment": "Malware payload", "value": "96f1428cc34e0b84629ff1e063d789827b2c8bf01121708450ab608ebf2522814a26198e0281fd51bf20079ba11d857a", "object_relation": "sha3-384", "Tag": [ { "name": "151-243-109-239", "colour": "#303BEB", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840777, "uuid": "e62e75e2-d266-47f5-861e-16a70d06dfbc", "value": "T1B0635B1137E9460CE1B65B3DA97B72428C66BD0ADF31D74D1220D00958E1710E476F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840777, "uuid": "75d076bf-f886-4d0a-b2d5-f98719c0fedf", "value": "12:8d/us0oGn3VUGen4SGno66s8XGWt0niDXmZrkDvBF7lrGCrnXqlhM6VhmNCdOblF:8d/k3pf6+iD2cpF7JR6rxmN4CsnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773840777, "uuid": "73932510-10a3-4ae3-805e-43d55717d74a", "value": 68825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773840777, "uuid": "f465713b-c854-4264-9883-752862ce26eb", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840777, "uuid": "72d16fee-df07-4d36-863e-ac457475a950", "value": "Zapyt_cf5d600.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b03be78-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773827223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827223, "uuid": "da962d7c-0257-4e4d-8f86-65ace8dcd401", "comment": "Malware payload (AgentTesla)", "value": "c9d5f8962672744d9f08c4cf6b39c808", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827223, "uuid": "7f655f5f-fa17-4305-9d59-17c7c4ae8621", "comment": "Malware payload (AgentTesla)", "value": "2ab4592a5934411ea3d6fd056bf19f2f7c9314e59e98c371510f73d8f211bba7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827223, "uuid": "ddce0119-15f6-4cc7-ae1b-228c67c00dee", "comment": "Malware payload (AgentTesla)", "value": "f232a9e0eb9b3d185179073d521737f7ee271ebd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827223, "uuid": "3b6a3238-d2ce-402e-9d1a-553f77017e95", "comment": "Malware payload (AgentTesla)", "value": "f201ec823d59c447c86832cf33d6f1cc6b1b475a465a6230ceb282a49fa9b2374beb0f158cfc1274b7d47a46546b594c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827223, "uuid": "77a35b6d-daff-4617-ac86-eaab290a9c5c", "value": "T123C2979D3EC3B1389225A0F36927A0667A6D9CC47308C456FBE758DCB92C334E165A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827223, "uuid": "5ce1d2c0-11bc-4c25-a65f-89f3d7477295", "value": "384:VN+cDppmOXtQII0YeMKWmamyQMwv4d0gu2dins2acifoDlLIpE1m1NkGX1e1q8:b+avmIfYAWMvs0gRUsQlUxtgA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827223, "uuid": "320c96f2-c28b-4617-9244-2cdf08c60423", "value": 27952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827223, "uuid": "94631070-aecf-4876-b5e1-63a613ad8c7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827223, "uuid": "f65b8e0b-b09b-45f4-8042-873bfc3ada68", "value": "c9d5f8962672744d9f08c4cf6b39c808.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087a17c4-2276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773802576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802576, "uuid": "16e955c5-1707-4604-b464-0e636ed37155", "comment": "Malware payload", "value": "7cb1bc28db043c8310997ea65dd19967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802576, "uuid": "1b358f22-23f2-4d2b-853b-1dab022f8705", "comment": "Malware payload", "value": "2b2937df3e5ae5465058b45ddaf6e46432613fa5ac678d4d64a8daf0c2f56bfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802576, "uuid": "7fe4848e-d5ee-4fe4-80c6-b0042692294a", "comment": "Malware payload", "value": "419f51141c8e01dc0a8762ec365c5f62065dc8fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802576, "uuid": "28df3ff5-bddb-4286-b3af-89e03bda4d07", "comment": "Malware payload", "value": "8dd839c84b8f32316e3552244d7e2e714438275588a826cafffff412c0a244da34f2392e1454fd59ab764ad055ab9308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802576, "uuid": "45f3999e-bd60-4e29-bb42-4bc6849a06aa", "value": "T10A2833334EADE4CDE3254DB87CE48E1C81E82D1D1A02090F9AEBF6789B256DE3D93515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802576, "uuid": "5916d478-86a3-4971-8552-eac652a09293", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802576, "uuid": "bc2e808d-27c5-45e6-8e80-2bd6b1d9d803", "value": "1572864:tR2/e6AbFzAvVqdHl0KYJ1jr/+Zf9as2DRR8AxLWtwFG47q9zim5APWI:ttvbhzxlCbv/+ZQsM8AxawspFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773802576, "uuid": "7c0b271f-7a9d-4b59-b600-6aab41d7d2ad", "value": 94866704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773802576, "uuid": "a6f32691-954b-4346-a83d-761da4ca0fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802576, "uuid": "307618b3-2d8b-4bb1-aeaf-d1a6d0894ee5", "value": "NetworkGraphicsSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558d2a60-22e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773849521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849521, "uuid": "f973b001-a71f-4a8f-b93a-277e3f13b4f1", "comment": "Malware payload", "value": "7fa1dc21a45e3eb1c239653603a0bc38", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849521, "uuid": "90484d20-7300-440f-96cd-700f2f2a70cb", "comment": "Malware payload", "value": "2b96f2c93650a0af493b7c959d3dc07f6763f5214ec8c0e0961d93a8ae969f44", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849521, "uuid": "fc5a856e-74d7-48d4-830c-e93926a10ec6", "comment": "Malware payload", "value": "1e421d136c25b1dce2d4273cd152899c7b439b7d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849521, "uuid": "0d5bd056-8391-48b2-9d1e-fb66e80313e5", "comment": "Malware payload", "value": "1df3a9b755b654fa89dcba980f050f26c5d8711468bb2d054ff4edcab07d9ce394d3b53746b71d74fbb0251198dfbbbf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849521, "uuid": "fee5fe62-01d9-4a7a-aa75-331b28f485a7", "value": "T1F5924CB516896C79FBD1CE399F3C6F4DADE882C42124A3ACBA4F3D205A1166DC70534E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849521, "uuid": "1a790197-b488-4590-81a6-2f7a2210fcb0", "value": "384:HPbcuQpWx+BL0SWL0g+zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:HD8i+BL0SI09zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773849521, "uuid": "5ba0c7ea-2ee5-4bb0-a51b-d83718a7a056", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773849521, "uuid": "527f5d6e-f995-422c-9b86-b2253d2bba18", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849521, "uuid": "fe31ae3e-7b2d-41d7-bcd6-a80a4dabf86c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afa34ee-22ac-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773825934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825934, "uuid": "9f85f383-a510-445b-92b1-fb495ebc0827", "comment": "Malware payload (ACRStealer)", "value": "53fcce1782564163fc684f2dc29c125b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825934, "uuid": "aa14e504-8acd-4650-85e9-1c641fe1d7bd", "comment": "Malware payload (ACRStealer)", "value": "2be8ce644fd8e4d3da7f63c190ffb4e312801fb1da2fd8711b0dab20f37f0e26", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825934, "uuid": "89cef1cd-2aea-4ab0-9f18-e497dc5d17e0", "comment": "Malware payload (ACRStealer)", "value": "c6b93cd85b914193fa36e1e505661d9a8eb29db5", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825934, "uuid": "c6deaddd-bbb0-48ec-88a7-94f8e6c59f75", "comment": "Malware payload (ACRStealer)", "value": "eee6395a0bcb30edc1f22cdab2d36dac4f0f0f85f5f69f7789dbcc9a9eacd14214fe8cbeb35cfe1b06cd72f1e0142fa2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825934, "uuid": "2d210d61-f37e-4872-a130-405a88066e9c", "value": "T144350B4B858168A7E3E301779517AA47BF39078906A7CD1B31FE51ED27A3AEC637B010", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825934, "uuid": "afb4d1c5-904c-47f2-9f41-a21653517a87", "value": "526663a80c6222bfc155327a08f53eb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825934, "uuid": "0aa42663-31f5-4001-8a75-247d7c65315a", "value": "12288:DYtsom6LjXGhY/Q+UIM6MmvCElnyYlwEk/YILFlQihA5oRLtBoT:eZRMmvCElHwEk/YILFlQihiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825934, "uuid": "fbe480f1-e6ea-43dd-8536-c79ce9d35b40", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825934, "uuid": "a494cbd9-6191-4d2a-93e9-12847ec6979d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825934, "uuid": "5eb7ff63-22c4-4cbf-aea1-b459b9e3b314", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcebb813-22a6-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773823549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823549, "uuid": "a31e7bc6-e82c-49c5-a4a3-6e8f1cb092bf", "comment": "Malware payload (XWorm)", "value": "289405532bebf12839412a9d288bf231", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823549, "uuid": "599e1331-a14b-41bf-811a-445ea6f747cb", "comment": "Malware payload (XWorm)", "value": "2c7829ad3fdf5698fdf93c8be35d2425e6129d566bbfdff280cd34462021dbd9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823549, "uuid": "e34c5ba2-e391-4dfc-bca6-e007e7c9fb47", "comment": "Malware payload (XWorm)", "value": "d18bf83ee5458f94fb07a6a18113b0754332b511", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823549, "uuid": "d9d3bc1f-96b9-4496-a89e-0157201b73ce", "comment": "Malware payload (XWorm)", "value": "507d2bd6638898be3d697eaf62d919fe1cc8d5e953520bf84f391a4824e75afb04a2b9555bd08c9fb7b1b61da2413b43", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823549, "uuid": "650747e7-9b25-4d72-9fcd-b02f472b3e17", "value": "T14DE07252478C152ECFA3D84290F9A2A92A8FB188A20626A203BE9800FC003DAC2495C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823549, "uuid": "cb859008-452b-489c-9a28-105b7a107bff", "value": "6:hSG8XIYAGQO0cR9R3KuYkeAILh8JJxuUcnK2LNKHcPr2rLTFd2RoXu1MFIsGd2Rb:0G8XIYAHpcR9kxAKG3xtcnKTHcj2fhwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823549, "uuid": "dbcc42bd-b385-4396-ac96-9434df6616d5", "value": 306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823549, "uuid": "66f9b85a-b9cd-41aa-ac51-1571ba593073", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823549, "uuid": "2bf103b2-d8a9-4833-97d6-3bb7aa9f99e5", "value": "payment.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae49ed5-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806822, "uuid": "1ed8c166-d4bf-4ac2-93ac-18a9ed9a94df", "comment": "Malware payload (Mirai)", "value": "b587c99df221295fd6bbc50d926340de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806822, "uuid": "0d7fe51b-edd0-464c-a5bd-2b4d4c586cc4", "comment": "Malware payload (Mirai)", "value": "2db8dd77b3248960aa7103a05a78851c0719b44366e80f91adfdc71ed57b84df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806822, "uuid": "620b79db-b83b-4894-ae7d-3c4322bff286", "comment": "Malware payload (Mirai)", "value": "cc55b9b6e96c83050a8b054ff335c02978f0fdb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806822, "uuid": "dbb5ad3e-b4f5-4367-a80e-78cb7107f209", "comment": "Malware payload (Mirai)", "value": "45bac28210aa201234295ef1488bb5f1b252c1ca33865129cb2319aa1e6dab959a4850574ede5ce166989bb8d584c91f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806822, "uuid": "d9b3dfe5-10b2-47c8-9cb8-ec900c1af915", "value": "T136142942F8814F16D5D012BAFE7D918E33131BB8E3DA72269D246F60378B47B0E7A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806822, "uuid": "85852fa8-0f57-42f4-a478-91622c85d646", "value": "6144:AnAW7RK8unx19Uat+YpX3oHO0aWJebZ/3:AnAWO9bLpX390acep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806822, "uuid": "fd8cec2f-62b8-4161-8973-25ff44ed757c", "value": 208092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806822, "uuid": "329665d6-48e0-4ec2-868e-2f653baab1e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806822, "uuid": "cf017102-98bd-46a4-8cbf-b032bc1c84dd", "value": "nuclear.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89741a56-2312-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773869794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869794, "uuid": "003332a4-a1ad-4455-b091-5e890baedf6d", "comment": "Malware payload (NetSupport)", "value": "504a149b0f8dde44b9a716e1ffd1a0dc", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869794, "uuid": "a3c123eb-6cdb-4e68-b962-b3dea55c17f6", "comment": "Malware payload (NetSupport)", "value": "2de3804d3dc568d887800b02782b212eff8607e4f44db729079fa5f7930a8933", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869794, "uuid": "a3faabbf-6660-421e-8293-54373aa40729", "comment": "Malware payload (NetSupport)", "value": "79765d3590989e43fbad965451b834bb5528f606", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869794, "uuid": "27d1c413-81e8-4548-8b67-5e20080d9662", "comment": "Malware payload (NetSupport)", "value": "1ff9d32dd9512403765baf43b8603429144a4c7397f9570ebd83c23d219107fe6d0233d2e7bd03e87771184b955badf3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869794, "uuid": "686419fa-8faa-4529-b101-cc424b36e021", "value": "T1CBE2F16AF0E7F5F5D63F263B0E8A12539838E50C33DB324905589DFC57D68E94A308A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869794, "uuid": "7fe614ce-9c38-41f5-a5b6-11d69322dae7", "value": "768:oL00tfvsq+7siVd2ZzeFD9Pa9kVcwmhyd1fS6Y/H:oqX7FTPAcRmK1fSr/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773869794, "uuid": "195189d0-2b44-4674-8dfd-1f76ecccca3c", "value": 32896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773869794, "uuid": "85132d83-fb48-4434-acdb-d37e0e9f0d9f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869794, "uuid": "69c0b952-5c19-4a49-8338-3c4c8464e051", "value": "IqtisodiyUZ.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9849ad-22a0-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1773820974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820974, "uuid": "218f3eaa-0aff-4199-83e3-df6f4d5e276f", "comment": "Malware payload (PureHVNC)", "value": "b74a53d12a1401d707be693a7285beed", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820974, "uuid": "10e32ba2-13a7-47a8-a6c3-5e25b2c3a365", "comment": "Malware payload (PureHVNC)", "value": "2ebe789f6c34a6e27c8ba379fdcc7b8d30ae0997b5564d3a844c5f2f30039340", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820974, "uuid": "72c9d243-120b-4173-86b3-b3e2ebcc963c", "comment": "Malware payload (PureHVNC)", "value": "33f5fba74e9d451ca959e22171063718ef9e1e70", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820974, "uuid": "cc50df6e-1ea3-49ff-a61d-433de456a199", "comment": "Malware payload (PureHVNC)", "value": "64b4a89f93821ec8995b525633fcaad2207111e354d55dbbf4525221623c0ce7c2f88427f15516a8277e850da16fad1f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820974, "uuid": "0cc90545-2a36-4dca-97e3-24fe3b3ec864", "value": "T181C49D7776538E20C29A0337D2C78A4193B8978676B7F74E7195239614023EFDE0A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820974, "uuid": "4d065a58-bcfc-44a8-a10f-71ca8b658fec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820974, "uuid": "c238c975-0557-468d-83b7-cba34dfe6a53", "value": "12288:NkvhAFzoqXpCPVUGGfV2G3l2mCtGWoWF:jNjZCuFVxgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773820974, "uuid": "d312d964-dc9d-458c-b7fb-d616b8531ec0", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773820974, "uuid": "0a77a397-fa50-4220-b165-3a2b36fff1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820974, "uuid": "c5c20339-83d2-470a-a84e-2ed49391e70f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276c07c1-22fc-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773860181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773860181, "uuid": "39ec6b18-f58e-467b-9839-2041f34377b6", "comment": "Malware payload (AgentTesla)", "value": "4e32db5ffa89a44050897da662b0ff5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773860181, "uuid": "bd0040b6-440c-4ae5-864d-d1ff00b852da", "comment": "Malware payload (AgentTesla)", "value": "300d84eaa7b7498e4ecc1535b0fa7742d72285bd2b5b7f90b9192ad7d9e94f40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773860181, "uuid": "f4af9ca7-a452-4f92-859a-cc1a8c61549d", "comment": "Malware payload (AgentTesla)", "value": "c677b9c9d3a6d6e0bcb2f5c5997a4e913ec4830e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773860181, "uuid": "4bab0ff7-103e-4c7e-90b9-cfcc7a555d5a", "comment": "Malware payload (AgentTesla)", "value": "5878c46c7addd433f5d853b60b32f55ee844d403b0b8a0df53c62f85579aad5bb2711070add58e0e22bf72fb50532af5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773860181, "uuid": "8c642d2f-b834-467a-bb2f-20602ffe101c", "value": "T1B535AE0273C1C062FFAB96334B56F6215BBC79260123A61F13981DB9BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773860181, "uuid": "89fe162e-4208-400e-ad29-606e7fd42f9f", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773860181, "uuid": "10f55b68-a1c6-40a8-a701-9a53774ddfa6", "value": "24576:X5EmXFtKaL4/oFe5T9yyXYfP1ijXdaqXphysbPI:XPVt/LZeJbInQRaqXHysb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773860181, "uuid": "5af95772-9ca3-42a1-a415-bfc175bcf279", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773860181, "uuid": "875d2996-c1d7-4510-a15d-396384f0e7e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773860181, "uuid": "c2dd590d-1d12-4bad-8917-a698266ecd1b", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bff501-2317-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773871954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871954, "uuid": "44e2a52d-01a8-4176-9df6-8a29d142dab9", "comment": "Malware payload", "value": "24eb5cd60837c0e11dea7f4e48bb610e", "object_relation": "md5", "Tag": [ { "name": "pw-5571", "colour": "#EA2913", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871954, "uuid": "bea0dc94-8f96-46d3-bd4d-88efab73282d", "comment": "Malware payload", "value": "32309b2ebf088d9f069343a247c799d1a1745d6805814051d86a1cd8641bd30b", "object_relation": "sha256", "Tag": [ { "name": "pw-5571", "colour": "#EA2913", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871954, "uuid": "5747fa06-2ab0-478d-9526-32730ae6d79c", "comment": "Malware payload", "value": "7a4f13dabd035f1925dc3c11a5eaf1f7f179e6af", "object_relation": "sha1", "Tag": [ { "name": "pw-5571", "colour": "#EA2913", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871954, "uuid": "37c605f4-577c-4333-8496-8d0e892009cb", "comment": "Malware payload", "value": "b752b335783e4d07f037c18a559eb7a9cc4c89191a47563ff4964aaee315ac4f9f5f46991a5df14e020e27c8efce92c8", "object_relation": "sha3-384", "Tag": [ { "name": "pw-5571", "colour": "#EA2913", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871954, "uuid": "3b03e8c3-a7f3-4d97-adc9-0b01fe13a01f", "value": "T133A733068796174068DBE76A28DDCD77362ABCC44453F7C195A4A8B8F2BC40F8ACED35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871954, "uuid": "8fa333c6-f455-4b65-8930-59081dbb2b40", "value": "786432:I4fPPQ2SfWYDVx7cCD+DUSj2sQSYouRdUCuAkqZ0+GgCGxEHqf+jDCTl:I4I2SfWCVdnD+DrQSYPRdNX0tl3Hqme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773871954, "uuid": "630e689b-2b97-405e-aa0e-1f9b0760728d", "value": 45901966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773871954, "uuid": "a7028cfb-ff0d-4a7c-8e3d-a288b7ad2cf9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871954, "uuid": "a16ae06e-0302-4f46-887a-78d3154d984a", "value": "ExpressVPN_12.105.0.4_Win64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf48b58c-2308-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773865616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865616, "uuid": "878e70cc-fbc0-46d6-b53b-d307f7c5661b", "comment": "Malware payload (LummaStealer)", "value": "d79e3999c79e4b14bf9e17e02bebf861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865616, "uuid": "6e928e1b-1032-4eae-836e-3a60e60b5961", "comment": "Malware payload (LummaStealer)", "value": "33afba83bca7836942c6731659a19495d313ba55ffebf0e5aceb4447a97f7ebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865616, "uuid": "ac87d341-fd81-47f3-b1e4-b78a843625b0", "comment": "Malware payload (LummaStealer)", "value": "aacbc76907afb8f9e77a94c5d96676df3153b8cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865616, "uuid": "a6223d26-a95c-4951-a20f-c4189d786c0d", "comment": "Malware payload (LummaStealer)", "value": "036e969e9e0341a700fa58bf5d2403ce9e36012eaf036552a676d6267fb1e60ae8a7ed5ebb2b31c2af2d27ad57a5c609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865616, "uuid": "3b2c5168-cea7-49d4-8781-0e65100fcf8a", "value": "T1EDA52382B3C590D4E575433198B3C43257793CA927E956EFA1ECFEA7B8331C09536A0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865616, "uuid": "712519f3-39e0-4189-9ebd-8ff0c6392077", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865616, "uuid": "363815cc-7486-4d87-af07-5dfddf370c53", "value": "49152:QSAyD2w5kCusw8Wq7vk10XdxqyW/PFUiJ3:QS7D2wKfsw8WIvk+Fe6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773865616, "uuid": "9c871bd2-0620-4982-924d-d347ab42d57a", "value": 2177536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773865616, "uuid": "fb57f0b2-3193-4ad7-8976-2d6219fcee66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865616, "uuid": "84801c3b-d5c5-4cce-8fce-8ec8d37c9069", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e47a356-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773827604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827604, "uuid": "46f6b793-eec2-43a9-abf7-24ea8d9c42ca", "comment": "Malware payload (XWorm)", "value": "b2590058a285a148e12ac6c58465b80b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827604, "uuid": "6400e292-eb2f-44ee-a623-637174e6d7fc", "comment": "Malware payload (XWorm)", "value": "3413a823ddc60cc3d6683b6d513227743d9cb7db92c7e55ed204704bb4f7f5d8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827604, "uuid": "53c9d598-255a-4c45-a503-88bd44de7da3", "comment": "Malware payload (XWorm)", "value": "b6de55a19893f06b71d7d2475105ba30f558180e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827604, "uuid": "8b6ce96a-4d44-472c-8e6e-8e504c6ba4ca", "comment": "Malware payload (XWorm)", "value": "348de66a1c9865f8203f975d73f15dc7e332b406357e7a1b77178af0f9ae2602147e4f1167ab6db87e48459d2613a576", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827604, "uuid": "817413cc-f2ab-4922-860a-e221e041473e", "value": "T1BA75056774B43D6BE209E88853EB9B480E5C735823DF21B12128DC1E4F993C6929DD7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827604, "uuid": "c82bc3b0-da31-49d0-876f-b61d579d4bb9", "value": "192:611111111111111111111111111111111111111111111111111111111111111X:P3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827604, "uuid": "5bf6063e-f6f8-4e77-8f2d-31a27e3be446", "value": 1577956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827604, "uuid": "11503321-e65f-491f-afaf-8c48eb68e9b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827604, "uuid": "07e37170-8938-4017-b158-cfb92faed0b7", "value": "b2590058a285a148e12ac6c58465b80b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e9e717-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773828283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828283, "uuid": "9e54ef42-dff6-497f-b506-0139925d044a", "comment": "Malware payload (AgentTesla)", "value": "5260d5b1845c077f99d8defcb19d5899", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828283, "uuid": "2191ffd3-3095-40c0-9c3d-805bc9bb8eb6", "comment": "Malware payload (AgentTesla)", "value": "354d8241540c781b288a98f2946712fa20b124dc29b25df9277aad2c594dfcff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828283, "uuid": "03712086-52ea-4b0f-aab6-2ee9f9c29ca1", "comment": "Malware payload (AgentTesla)", "value": "80f94edf2566b8d9885c070da7355ad6468ae474", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828283, "uuid": "5c1655f3-1ed0-4668-9f13-3ad541214aef", "comment": "Malware payload (AgentTesla)", "value": "10f3173023caf02993cf52bcabc0912842bf28658f415807d7c194433f3d46e9d526c7430feeebaae0b8bb69f059f846", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828283, "uuid": "90c983fd-2761-4de8-8fcf-da4bc9888fc9", "value": "T10C5512C857DFB9D8F1D9AD1D064FE94019CA93B85F313D13D62ABF658202EA05122ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828283, "uuid": "e6bca2eb-e093-4e0f-aab6-447aee380aea", "value": "384:Piiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiix:M8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828283, "uuid": "540964a6-6c21-4329-acab-1f332022e680", "value": 1361742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828283, "uuid": "06eb0fe0-ebb8-4961-9147-0033b36e4b32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828283, "uuid": "0a7f627a-f904-4e90-b354-52fbfc30f08b", "value": "5260d5b1845c077f99d8defcb19d5899.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84956bbd-22d1-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1773841869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841869, "uuid": "1593700a-f645-463f-b04b-9ed428a0eeda", "comment": "Malware payload (PureHVNC)", "value": "fb923949c35db32a7f5033f278e4af0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841869, "uuid": "97e27b39-1c8a-4f58-b668-ce7fdded94a9", "comment": "Malware payload (PureHVNC)", "value": "356692ba173ea9fe8eafbf0173f6238d93f635e80061888b98a217477bfddcd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841869, "uuid": "cf17cf67-97e0-4cf2-abfa-afa536241c01", "comment": "Malware payload (PureHVNC)", "value": "feafef2ab1872a58d46665ff4e11e64bd8f1b53a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841869, "uuid": "ebe5efb9-b268-479d-90c3-c29af265d253", "comment": "Malware payload (PureHVNC)", "value": "3cd026962b813d8298ecfa22cda5a409d13306b4d4d22eb70363414e758a7248429fba20cb8e2b1cebbc5d79d9a6aacc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841869, "uuid": "d968b54a-9d01-4beb-b5de-1f4fff55ed78", "value": "T103D49DA7365A4E10D2850337C5CB494493F99686B6E3FB0E765523A618073FFDE0A3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841869, "uuid": "3685faa0-a930-457f-b0ad-f776481f058f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841869, "uuid": "32bd7ec2-4aec-4aae-8953-4f9bd56d4459", "value": "6144:TrfBg7FvP0vP3W7KACHQVpOURUYpzQd5UkpGXvXDUZpYXJXU3dckKkU4php0Utdq:Ta5J2ijulSxUegCRaxRCTLQjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773841869, "uuid": "a3589adb-e5da-4d8e-9102-8bc9b8d69e9d", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773841869, "uuid": "03753fab-020d-4957-9306-7d99a73c73d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841869, "uuid": "9d8b2897-6220-4ec2-8079-834650ce2688", "value": "SecuriteInfo.com.Win32.MalwareX-gen.62387464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3b278d-22a9-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1773824809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824809, "uuid": "66764ffd-0c42-4c91-9b0a-df9654828f38", "comment": "Malware payload (CobaltStrike)", "value": "5507e4b0c99787e53f8dcee3ccd4dd06", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824809, "uuid": "a464c08d-dffe-4ce1-9c69-b7e349200094", "comment": "Malware payload (CobaltStrike)", "value": "36154900a5d00096595167edc83315a29646f7db240af5abdbe27ae872833f37", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824809, "uuid": "386a6d27-c9df-468b-bf41-cce616e8b92d", "comment": "Malware payload (CobaltStrike)", "value": "dba8581592414a2315c7d6c32fd4f80d6a7f030a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824809, "uuid": "af1d0f4b-161e-4990-aa8b-0d4b0b3dd671", "comment": "Malware payload (CobaltStrike)", "value": "5d3eca367e4211b54c18cd829147af4a715999275568b056549f34b77874f9d961cd8534bc0fefa01338fd304d74077e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824809, "uuid": "10c24fb9-5199-4a67-8a40-48c7095f37d6", "value": "T197B4D221AA4F62C5D2EA1BF0E473317656506F082CF9B42F10A97D267FBD983B093C95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824809, "uuid": "335369db-7c53-4cfe-8aaf-ee7f89bcaa16", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824809, "uuid": "1f6b72a2-2f66-4eae-a3f7-bd368d47f2da", "value": "12288:Lk745WaMOc3YnGst2jo9999M9999FIpippGByxxxkxxxkxqxxx:gmPcgP2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824809, "uuid": "2465b68f-cfaa-40f1-8556-a7e5b86b4345", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824809, "uuid": "ec0b2b55-4287-4a40-9b10-f3cc9a170b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824809, "uuid": "2f4c68fe-8044-47aa-b612-2d5262e6d997", "value": "36154900a5d00096595167edc83315a29646f7db240af5abdbe27ae872833f37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fc1e16-22ec-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1773853256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853256, "uuid": "7787acda-8879-4e8a-a2e0-9965f69232a2", "comment": "Malware payload (SimpleHelp)", "value": "b861377796b837a0472c6925b4638d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853256, "uuid": "0bcd92cf-35c9-41ae-acad-e42a1c8fa3bb", "comment": "Malware payload (SimpleHelp)", "value": "36189b508dcf09a63a8462c11beb5b134d95afa492061f8d9a102e24651b697b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853256, "uuid": "1fc89a34-bd8d-4075-ab46-06d9ffefd2c3", "comment": "Malware payload (SimpleHelp)", "value": "61d4b61d6d483ed33995864ecd40ff1e1170834b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853256, "uuid": "53ec58c9-2377-4728-9933-c525c597df02", "comment": "Malware payload (SimpleHelp)", "value": "a0bff28ae3063e529e4e847c70a830ea9a11acb728f89b270bcec6770e3a6352955d8872caeb795385540c6dfcefd82c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853256, "uuid": "1a20e279-4543-49ff-984c-e3597728e153", "value": "T1CD85016AF7A618F1D9A7D838C6928763FFB17168031462D707A08D666F733E06A3D305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853256, "uuid": "a01beaa2-8c8d-4202-a8eb-ea9ac4ee58d9", "value": "4dcdd102066c792bcf91dce0ad10afac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853256, "uuid": "cd028ac9-17d8-4522-a948-ea0b6159ac7a", "value": "49152:0aHqbMGOOMRjiornbPOBrwIt2OwihPJSfkKIxVV:lTdZiJrRDwIBSMKIxVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773853256, "uuid": "7103590b-de0b-424c-b268-6b65c85ef3bd", "value": 1725848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773853256, "uuid": "795469f1-5ab3-4259-a4a8-4b5f49cff161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853256, "uuid": "3d364e7a-88aa-40ce-bace-f28dfc1fcdcf", "value": "Inder-POL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3116729b-22b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773828844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828844, "uuid": "880c950a-2eac-4ded-9d48-289372faa90c", "comment": "Malware payload", "value": "f8d7f49d50be5ca776b6e2e83d5d82e9", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828844, "uuid": "b856abd7-b1a6-4a3d-957f-42b756246134", "comment": "Malware payload", "value": "36aeb37b60b800e78ad2c0f754de0f0051fef5596099b391fea7c4757552dac9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828844, "uuid": "5c4c8c0e-1efc-4018-b66c-b4113e8f7d62", "comment": "Malware payload", "value": "ac4a97461db712d856ee471df278fad717a732ea", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828844, "uuid": "7816dbfd-2fe0-4e18-ad6d-523ccfdecad2", "comment": "Malware payload", "value": "452d1a6bc8dcd9e73989fc68a080c66f8197b9d961e4e7f37f9be4d61b33530f7b9c1016b692b9aa1817663019c6325c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828844, "uuid": "c850c2b8-5d3b-4747-a355-c4bfb3fa6e9c", "value": "T17951E11467F94214F2F39F7698FAB7129939FD22BD22CA7E0041438A49B1A00AD65F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828844, "uuid": "67532a86-e5c4-43fd-9646-6fe9a44444a4", "value": "48:8y9tchdB5hEssGmi7K0/+3S7ZbGSGW8+ZMW8U8pSaZkiSpIcfaxr:8ycXB13mi9/+9BSiSpDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828844, "uuid": "51f8d95f-4ef6-4a6e-b5ee-2a6ee59f3175", "value": 2813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828844, "uuid": "2e6f13cb-d1c4-47ab-b2ad-06bc304f5978", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828844, "uuid": "e4a6e9d6-941a-4572-b8d7-d66e9181bb41", "value": "30fdcd36-6cd2-7972.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5ee826-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851571, "uuid": "771de7ee-356b-491d-8ed9-ac01ff623a76", "comment": "Malware payload", "value": "829d0c76c38d12b5c1152501237ce636", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851571, "uuid": "c005b592-37ed-4384-945c-d510ada2837e", "comment": "Malware payload", "value": "37c8fbcb3349b8d4d694df416c37938210f0d4785b81648396ec36820c3f25a2", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851571, "uuid": "53a8cd49-f1fb-469a-90b2-141e92af0862", "comment": "Malware payload", "value": "0a7f3be0c96b635faa962ad3e76c3e04c9fad940", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851571, "uuid": "42319b54-0107-445f-a13b-37ec79e4c290", "comment": "Malware payload", "value": "ac68915a978056e29d10758f8341461227ab408c1f95d45bb29faef3ac5821cabc9f47f7f36ce5b8fefed50753f0dd37", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851571, "uuid": "aade55bc-17b2-4881-8b72-50e48c765a32", "value": "T13AD301E08E9F86C66539F121486AD941FEB4071B06A07854BF9CE1F61F352AA3077D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851571, "uuid": "2dcd0fcb-cdbc-4612-a659-61da05fffc78", "value": "3072:n+mwr5Onk5FL8lB4p/m71HexA0a7UkenRIWkB/5PavLE9j6sovjVFK:+mwdOnk/hO1zERNSP56xvjVFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851571, "uuid": "0a9d26b7-a336-4b2b-ab83-2d43319601b3", "value": 142880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851571, "uuid": "ee5f96b1-b705-461e-80d7-548b98bd32bf", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851571, "uuid": "817a0cd7-9466-4969-baa8-c60079762965", "value": "1SPhMAR17_Annnnnnn.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d709d68e-22cb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773839430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839430, "uuid": "c65f776c-ba29-4651-9be2-9246b77f9910", "comment": "Malware payload (AgentTesla)", "value": "c80a6bed9f785951eb71e233429fba07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839430, "uuid": "92acc642-c5ac-402f-9a43-6eaf50a532c2", "comment": "Malware payload (AgentTesla)", "value": "3823c5baf2371cd528832fdebd14638f5829d490ace6e598b0a5a0442a8f8c26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839430, "uuid": "07646d5a-ac3c-4b05-930a-8e78cb10ee6a", "comment": "Malware payload (AgentTesla)", "value": "69c0906044e736225c72f28a6d296ae869062abd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839430, "uuid": "7d45a7ad-5800-4fe6-9768-41cb51e71256", "comment": "Malware payload (AgentTesla)", "value": "a5b5633aa8e389065aeed02ddfbd80e79bbc4d170f0973afe4a22f7149ab476286d6c7e6fa6ac33cdf22ef3e9814414f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839430, "uuid": "194801e5-b72e-4793-80e1-44fdec647c1c", "value": "T19F261944E1949B98FD62DC396762AD9081A963DB6E858D32F87C59BCBFF30F1242101F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839430, "uuid": "5b1df1d3-dfc8-4593-9c6d-6ca49ac97ce6", "value": "98304:2Ic264ZI3ueZ1F5WidyuD5yEV50LhIsPqj8sv+FXs1/x3kU3p2kTqbmK9ikR6HOn:nc6I3ueZ1F5WiHD5pV6dzs2Fu/xlp2dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773839430, "uuid": "8a2abb5f-e8e2-4e05-b2e7-6a7f64cb27bd", "value": 4832224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773839430, "uuid": "611c8f3e-bc1c-4f86-ab6a-5f901020a867", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839430, "uuid": "649c1c1d-c519-4309-b19b-edd525460f8c", "value": "PO 36222.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf96c39-22e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773848968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848968, "uuid": "01d74a92-ef07-4ff2-a888-93a1ce34044e", "comment": "Malware payload", "value": "43fc07759c8cd3798d863e1f785ff176", "object_relation": "md5", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848968, "uuid": "a72fa946-e516-453c-850d-8cff1b02f336", "comment": "Malware payload", "value": "38c55481911e7f789fc68628c7b9d9a2f8139524ac2deffe85ffe3ac9dce8178", "object_relation": "sha256", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848968, "uuid": "3856241c-716c-49eb-954e-53a78bb27c0d", "comment": "Malware payload", "value": "5bd67bca22bd44a09338520cbac7950928ed68d3", "object_relation": "sha1", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848968, "uuid": "11f901fd-3584-42d8-a0c7-3001b408981b", "comment": "Malware payload", "value": "bac307db3e10768c2c461c37815e62c789303652bd78a6af39bb8f252ecd156a3c154ee05aa045b4430258602515d4d2", "object_relation": "sha3-384", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848968, "uuid": "55ed157f-f621-43b5-a3d0-d122ad620ee6", "value": "T156083390658A1852C282EC3F2245169F07D4E321ABF3BB5D8F7E67BFB393D509A94143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848968, "uuid": "d3bb7779-3cbd-429b-bd36-8bd52cfa7993", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848968, "uuid": "ea701076-91d7-400d-80ce-e40b3395a168", "value": "1572864:Dy2um4Ndc20ujnJag5CFZtJttVyt7UQnhoDO2wGuMqtlPw2VjtvdaKOb:DyTm4Pquj9CH1yVN6DATMN6jFoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773848968, "uuid": "c4fac40e-aa1e-4f16-970a-43ca4f0d59bc", "value": 78000072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773848968, "uuid": "10955642-8b7a-4295-94b8-d312f60bf726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848968, "uuid": "81fb65b4-be06-41b3-b6e6-8361662d6e8c", "value": "38c55481911e7f789fc68628c7b9d9a2f8139524ac2deffe85ffe3ac9dce8178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631f7c16-22d0-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773841383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841383, "uuid": "729d7674-d492-49fe-a8e1-ef30a1290e1f", "comment": "Malware payload (XWorm)", "value": "93a5fd13caca347b56f027bd7cf3b813", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841383, "uuid": "a06d2d03-d4d1-40ff-921f-f3bb7d809ee1", "comment": "Malware payload (XWorm)", "value": "38f22fadabc43752dca980f573ec4b0b66d585697e103f7b35ddba449babd941", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841383, "uuid": "b6d22f02-a441-4e28-949f-0f5b320e777e", "comment": "Malware payload (XWorm)", "value": "4061f73053c94517aa35472267cadc1550a94c20", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841383, "uuid": "13279179-9362-4f9a-b462-dc5ba1b90b16", "comment": "Malware payload (XWorm)", "value": "23643250d92e23b5c1d5723a83d44a307a407973c74da4526988cd7f96389bb1621e5b9f5115f76c638cfc23b2f77ca0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841383, "uuid": "60371c74-a9f5-4ade-880d-f4df1b425862", "value": "T10E834CB1DE5405960E0727AAFC552AB1CABDC55A462300F1FEDC531E900B6ACA7FE31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841383, "uuid": "ae0d668a-4eae-495e-9a4b-829e69bd798c", "value": "1536:t8EHzReHmhnsXIab/Wj9jcmi7G0khfwYrDxAiZPe9bJ:t8EHzUHm+XbWjCRCiileX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773841383, "uuid": "247ee8f0-ca98-4c47-8619-94be42ee7ec2", "value": 86238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773841383, "uuid": "f02e3829-32c5-4f30-bc84-c390415735a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841383, "uuid": "926142c3-61f6-46bd-b6bc-240cc48ee5f8", "value": "acc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c563f733-22fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773860875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773860875, "uuid": "c5c2a57a-14de-4629-9d6f-636f7978d2b5", "comment": "Malware payload", "value": "36dc5b78b4f86fd764a5fa90a5586a0d", "object_relation": "md5", "Tag": [ { "name": "pw-Phantom", "colour": "#87D9F0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773860875, "uuid": "a22de393-3b27-4cba-952d-10421fb5ff05", "comment": "Malware payload", "value": "393fc85c62f98031ad989d77d572d372e18779abac75a6041222ffcb900bff7a", "object_relation": "sha256", "Tag": [ { "name": "pw-Phantom", "colour": "#87D9F0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773860875, "uuid": "9247e8fc-5b88-4a75-aeb1-20f412473bd3", "comment": "Malware payload", "value": "a9e93aa31e3b3a627db1dbe9ba519f986d6d800e", "object_relation": "sha1", "Tag": [ { "name": "pw-Phantom", "colour": "#87D9F0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773860875, "uuid": "0c4913cf-d294-427d-b0e4-513d78451253", "comment": "Malware payload", "value": "b4c8148ebf76c96df38fdfcb45e6a420a37bc84756f210f833c1e3537280da7844801230098189265bc5441e731960ea", "object_relation": "sha3-384", "Tag": [ { "name": "pw-Phantom", "colour": "#87D9F0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773860875, "uuid": "9852ae67-336a-461b-9229-91e8e0ad1c75", "value": "T1A018332F88E4634185B8EC2A6B0439F3DD72EC416EF53FF3BEA5713158266512B991B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773860875, "uuid": "bf77be99-b2cc-4378-aeca-9f869a099307", "value": "1572864:jyt4Zo9l81lnfu8RcRyLuoLY4g3z4RMY/0tY6Rt50DAjc86anx7:6ONW8q2Y4g3jX5eAt64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773860875, "uuid": "2a8c04f9-e823-488f-9027-2166a634e7c3", "value": 90658958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773860875, "uuid": "a38d5dd9-ddc7-45ac-8acb-0a6a29602fc2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773860875, "uuid": "d8598490-72da-4af9-9cb6-04a8afed37cd", "value": "PhantomHack.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c62634-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800953, "uuid": "93e7bff9-1e58-4262-bcb7-e4fb1342c73a", "comment": "Malware payload (Mirai)", "value": "05af790405137f5ff6ad17b768dfe61b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800953, "uuid": "d97efbe0-85aa-41ac-95a0-129ceb6e26a7", "comment": "Malware payload (Mirai)", "value": "395dd5b4d45768d2799c94d03ef34a06360029080a8d956d89cde5ad0892204d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800953, "uuid": "5e563b68-3691-400a-8241-c445e975d8b4", "comment": "Malware payload (Mirai)", "value": "750175d0fdd5e79a80b233374537e4f25514248b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800953, "uuid": "15cc23f3-5fb8-4949-92ca-c25974a5ec6b", "comment": "Malware payload (Mirai)", "value": "d0713867964e4f9653766450a147842bbb0eacf82a577a7e3fe96ac1fb4ff4a6696403e27a3d86817085e817af9a4cfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800953, "uuid": "010dab53-72cd-453e-b47a-4f9754f9e5bd", "value": "T1FEB2E1E8D15FDF0FD8198BB6534B845FD9B1261A835EA341A7898AC26C9106CC0FC4ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800953, "uuid": "4c2a1bb0-c14d-4c3e-b1ae-5ab458a183ea", "value": "384:M0CgiIrRE0F39OQtgvVgSgUoGI2LYWnyJaB+nfaPGZZ61dNfpbLGUjHLv1RN:KgiIVEW39OQtgvVgjqX5caB+yPGP6Fpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800953, "uuid": "e99bcc9f-5590-43dc-841e-c48b4f95686e", "value": 24008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800953, "uuid": "c598a166-2dea-476a-8973-c571a6615a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800953, "uuid": "bc5f9f05-e076-473e-bb39-dcc64a0d22dc", "value": "dontcrynow.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6aee000-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773826518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826518, "uuid": "d6b38955-bc4a-45b6-b9c7-ebf5bf92d0b5", "comment": "Malware payload (Formbook)", "value": "d5ec97d61eb6c1ac66619a72324685f5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826518, "uuid": "cdb5db92-addd-47ca-8a60-7c558b328d27", "comment": "Malware payload (Formbook)", "value": "397c02a073aa646aeb721f52abd8b3c912716e24cf34efea12a52016cb7bd471", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826518, "uuid": "97b85fd5-843e-4e5e-87a2-48d220b3b293", "comment": "Malware payload (Formbook)", "value": "1520c13bf1b940e1a81995d0ab77e1e47de59515", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826518, "uuid": "f7c9ba47-cf6d-4827-a186-adfd29de5656", "comment": "Malware payload (Formbook)", "value": "7a1011277e3f60f0126dedd3945e005bc4df1c44dc0ec8db1d2b85da51212309099144f070be0a916da8176277c1272b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826518, "uuid": "81aabbc1-40f8-4a3a-af80-4d4b79dadccb", "value": "T1FF6533659FE5F59BC9A4C07A465E89A5CBBF1D303B61272F12C03DEF8812D508E87B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826518, "uuid": "caf664e0-9e89-46a6-8e61-e66c782898e8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826518, "uuid": "2d12bb96-639b-4559-8253-1e15b2b41363", "value": "24576:k2oWLv/1/CL6rrjpPwmiihu4q/hANoqgPU1LmL6bwC5+UmYAiZI/BK2AQ:uWLvFCiWzLmNozebwI2AQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826518, "uuid": "00c88a95-5f79-4f88-8aef-cad20d58156c", "value": 1509340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826518, "uuid": "746f2197-3eab-4f51-9def-3b68560093d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826518, "uuid": "4a6cab87-40ca-4c20-a36b-7d7de7640df6", "value": "d5ec97d61eb6c1ac66619a72324685f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b388f2-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773825196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825196, "uuid": "1daae0d7-241c-485b-87a9-259fae542f60", "comment": "Malware payload", "value": "f21f57c15cb09ecdbabe4d6767b6f6be", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825196, "uuid": "32713331-d812-49cc-b5da-fe7288eeac06", "comment": "Malware payload", "value": "3a76ebf22840e55487462ce0ad146f473033f1bd1b49aaae0aba8036a420e543", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825196, "uuid": "6d443d9e-c12b-4085-93fa-7dff0e11fc1b", "comment": "Malware payload", "value": "d8aa17eb168ed52d198f50d791fff9af9983fd99", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825196, "uuid": "3aeb1574-1748-4a9b-b0f0-afae8952c071", "comment": "Malware payload", "value": "d3881bd2134fe9d144e3bf1cade6476a431129b0b32f9ca3f31cdc3830127c3ed4bce147350a6a83a1eb56a7003c88bd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825196, "uuid": "d73fa0c3-0a6b-4244-a4d3-be3c6429d09e", "value": "T1DB2412ABC48BCDEACC3EE03E62348DD9B215794BF25678352829646E35113DB315CE27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825196, "uuid": "ffa4cee9-3ede-4836-b871-b62209cca462", "value": "6144:V+725geUsZIUbbuzuQjzbU23umBhqkW4A9TKlf6WWLey:0MGaXCCe0ou2aQiSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825196, "uuid": "ca2778a6-b84e-482e-b05b-c2723eba068c", "value": 229369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825196, "uuid": "9bc00c52-d33f-46a7-88e7-e669a2c9463e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825196, "uuid": "619be415-da0e-466e-914f-4a03cdc30899", "value": "f21f57c15cb09ecdbabe4d6767b6f6be.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93620fc8-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801521, "uuid": "00796785-8371-43a7-96cc-2519a07a7635", "comment": "Malware payload (Mirai)", "value": "d4a577bf8f5b16e7a28db24214d917f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801521, "uuid": "8e174222-dd47-4785-943d-721760c9503b", "comment": "Malware payload (Mirai)", "value": "3acd824edceb83822206e631aa5e5188a4c0794dd15cb437c5422c3ef29eb4b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801521, "uuid": "f3acc874-fe0c-458e-a3b0-b73f82d9e30f", "comment": "Malware payload (Mirai)", "value": "d15fe3e7ba4d11d663bf29c74e694c6ec73bb299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801521, "uuid": "d77e93c7-30da-45b9-b1b4-03e5df4d0f20", "comment": "Malware payload (Mirai)", "value": "0e9d45a3b82e44dc9fca84d46e0f71a589f4b12347d2619be7f6e9cb0974a61b5d68f7fc579c792bf17f658367adb9ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801521, "uuid": "d3e9d504-8623-47ef-89a0-d5089cbbd13d", "value": "T150536BC9AA43D8F7FC1605742137E7334632F139112ADA8BC7A4DE36AC52A01E62739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801521, "uuid": "50f81b78-45b5-41a1-b599-1f8369e17bd6", "value": "1536:EeIFQISZslCYoGDDyuj3ajDptXQ5tiSBtqXYjIfK44KSVXB:Eec8ZslCUia3wQ6SPqIsfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801521, "uuid": "26272e31-c039-41fa-9731-6a973e8e2104", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801521, "uuid": "069fb2dd-9e52-4292-8764-7ecfcc2101e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801521, "uuid": "d02c6715-fd4c-408a-ad4f-15f274b15d40", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191ac774-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827945, "uuid": "5c1f4573-2bd3-4940-a2c5-57ca45acb579", "comment": "Malware payload", "value": "e9b630d9c29c2feb01bef44bd5af3f19", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827945, "uuid": "fbd01b2f-a48c-4b11-b144-40b1ab0c14fb", "comment": "Malware payload", "value": "3c044e6ddaee508ba512eadabb2f289f6424cbf082f77754c57be570eeab499f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827945, "uuid": "48f96497-c6a4-45f9-b7ad-693526679c10", "comment": "Malware payload", "value": "843f68909f9e4d93909f882b059a40675abd0dee", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827945, "uuid": "4b24f337-dab3-49db-b5fd-bb67d356adc6", "comment": "Malware payload", "value": "29c5027eeee6664716326761007ca6818ebf25d5ea3b8635cb24b34df5aea9a72b4045cbfb394c69d8da25056ea83433", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827945, "uuid": "032ee788-74e2-49e2-a095-2b249043dd77", "value": "T14F5512B35966F2E985C21CC7A4F822B1F87AC906DFE0183DE34E967652B712D5316EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827945, "uuid": "8b23c5e2-eb99-4f20-a4db-05ee7218aaf3", "value": "96:noPWscJDID6D5DzDqDID+DfD6vVY5vVvcDdvcvfvccJvcvfvccJvcvfvccVvcvfF:oPWshIiHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827945, "uuid": "1d567816-d5e1-48f4-b19d-71c80ec65c80", "value": 1346767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827945, "uuid": "92606a75-58a7-4b69-b87c-d8057357ff90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827945, "uuid": "f5f7fe43-3b2c-42fd-84fa-7068fed19123", "value": "e9b630d9c29c2feb01bef44bd5af3f19.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4cfc9e-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827255, "uuid": "25008c64-00a9-4b04-9993-af198fd67515", "comment": "Malware payload", "value": "8df5e4408621b29c79643f16fb8e151c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827255, "uuid": "99c95c24-0756-474a-be48-3665b0fb3132", "comment": "Malware payload", "value": "3c2e36170ec94afe95452247ca0da5f0ec0c035461eaf8f2f2449c8c5b1bdce4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827255, "uuid": "89a0b3c9-0f14-4457-bf93-73c4f9f6e8fe", "comment": "Malware payload", "value": "128c92265d7406083587631e3bf3ec0b6bdb45c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827255, "uuid": "976b32c6-31cf-43d7-9809-9c26eec26df9", "comment": "Malware payload", "value": "2a160ff7a8fe9bf6f937e57d368af4f2d976972f1134ced8b5aa8bb6b79f38f33dc35fa78a236ea6f5659dc7eb60e7fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827255, "uuid": "5306aec8-329e-47ef-a724-57e68174d0ab", "value": "T1003513ED53BD4F847BAA20A53C7D76C0D8D00A89B8B3F79320867ADC90CD5C91F25A65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827255, "uuid": "4c599b35-4058-4d78-b818-cde8e8d01df5", "value": "48:ojTpEPcFbqqrlUd6vNzhBjdeIthnS79bfHbCfabyjgDjUjqTsjvl:oCg1hBRS793CYpY7Dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827255, "uuid": "caf27bf5-a7da-44ae-9427-5cfc533a0574", "value": 1108399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827255, "uuid": "ae94dc3c-31f9-4793-9fd8-4b8b00555808", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827255, "uuid": "651731c6-77c0-49c1-94a3-8fd476eaacd3", "value": "8df5e4408621b29c79643f16fb8e151c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e65589-22c8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773837927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837927, "uuid": "4dad09fe-bace-45c3-aa05-8ebd8b51dd1b", "comment": "Malware payload (RemcosRAT)", "value": "78bb6c75b2e57e3ae84acdf8bff8f862", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837927, "uuid": "dfb1b04b-ad62-43e4-9900-6d80e6756665", "comment": "Malware payload (RemcosRAT)", "value": "3c594b6652de9bcb3f072008dbff1f4c35c56270acb65574f01ded9bed95bbbe", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837927, "uuid": "3411c5d1-18e9-4dbe-9543-fac118a323d4", "comment": "Malware payload (RemcosRAT)", "value": "bb88896e1ce8af2116071ae1c2eeaca8787f46c8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837927, "uuid": "8a61af01-319c-4a10-891e-afd2dd0710f5", "comment": "Malware payload (RemcosRAT)", "value": "1ec02d3ab821a3acf97d8384158f249b598b6d17b6342329998699970120a86edb4bdd246dd756d7752ad5962cd5bdd7", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837927, "uuid": "74b906d9-1666-46ad-be6f-06fa232b5214", "value": "T123C2D0EB426F18321FF619127306F8A67992E0BF454D5FE791863793869C038B8A1377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837927, "uuid": "944f99d8-85f4-472f-90e0-1e2de38a0ac8", "value": "768:DNVrIL+Kpgh2Xcfa7S7tDLJetBa6g6X6y6q:TULmh2kzt/0ba6H6zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773837927, "uuid": "aca04573-1ee8-4d3e-8b08-d02e43850ae8", "value": 27456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773837927, "uuid": "950e6fbf-7693-45ec-9546-5acb49d757e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837927, "uuid": "b7756375-4266-4164-afe4-60a595ff1b24", "value": "$33,456 sport swest-Payment-Reimbursement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e337ab0a-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826995, "uuid": "e2eb3f6f-8ce4-46fa-b192-e07482fa75af", "comment": "Malware payload", "value": "dbc5e829cd35294b2988730168dedc13", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826995, "uuid": "42ac261c-46cc-40cd-a061-2416bb9804a1", "comment": "Malware payload", "value": "3d4c2a1d3b9ea2d8d8790a5aef5e73add848e6f5a07782ae4e51a978149e5c12", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826995, "uuid": "d2fcccfc-2b6d-4984-928c-66a6fa1921c1", "comment": "Malware payload", "value": "b7bbe13e8e891faf1fd286f5aaed302817c53d7f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826995, "uuid": "7170cfc6-9ed6-405a-b7e5-d941be4f904e", "comment": "Malware payload", "value": "1e350d79b54b909452acc72e0f55679a665c0fbae422948299703d214162cea54caa2fedab30b5c5676db8bd4325fada", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826995, "uuid": "92ab9900-2866-4e86-9472-ca845671fa9e", "value": "T102F312BA2E4F52EE127805CDD8F6CB4942C5AD50EA24BE7C1FE6D8DB46990C45E3C321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826995, "uuid": "9ad139ce-7552-4c3b-8803-b5ed4b619e72", "value": "3072:ey2pXL7pG03VzD3ATN16M0UJMd7yWAVAMsEmm/FjigV4yyF:exL7fF/aX6/7ycMsFUji043F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826995, "uuid": "533c69ce-0d78-4eaf-b550-3ad03ea21b53", "value": 160671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826995, "uuid": "0bcaa210-31c3-4214-9a4c-4cdc994f7b65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826995, "uuid": "5eef4fff-c6a1-411e-80cb-f8a17e87b1bf", "value": "dbc5e829cd35294b2988730168dedc13.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57afbce-2316-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1773871640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871640, "uuid": "f8be95a5-fe1c-458b-845a-a7accb5b893c", "comment": "Malware payload (EternalRocks)", "value": "e60fa55fb4c7b8d6c9825d7ba5117031", "object_relation": "md5", "Tag": [ { "name": "83-217-209-92", "colour": "#367B91", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871640, "uuid": "d6fefa95-8322-4cd0-893b-111c47730f58", "comment": "Malware payload (EternalRocks)", "value": "3d7e9e61ddc414e65a76eb579c0fa65edb1298d4b000b85105c7b7aad468b1d2", "object_relation": "sha256", "Tag": [ { "name": "83-217-209-92", "colour": "#367B91", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871640, "uuid": "3e505850-cda1-40be-93eb-0c3f1e1f5235", "comment": "Malware payload (EternalRocks)", "value": "2000ecf41f04f208ce764bfed06d68c0bc0a4015", "object_relation": "sha1", "Tag": [ { "name": "83-217-209-92", "colour": "#367B91", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871640, "uuid": "98ed0ee3-afe4-429b-9081-a74f307c91c3", "comment": "Malware payload (EternalRocks)", "value": "70101fd97a6f00ae9fbb08610783ce022732a60abf85534d7e5e7716d69fe3a5b1639e2acfdf6e19f9f9752d87863688", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-209-92", "colour": "#367B91", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871640, "uuid": "5bc7ed5f-1150-423b-9d43-70a8c2293b58", "value": "T1F476AE0265408078D8F2527F252DB76C9A3D6D21AB2249DB97B0FDC82F75AC1683E35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871640, "uuid": "bb783052-4eab-487c-97f4-e8c9e2acc3e7", "value": "0cb9ddd03c410615906fd38b3bfce480", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871640, "uuid": "ca7fd5e0-2a16-4235-acf6-c2354735d31c", "value": "196608:EQZg2rx9DbL37tOnftK7zedHXFre0xz/:W2rx9b37onfBHVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773871640, "uuid": "1815b826-d187-48f1-856f-cd9333b14291", "value": 7353456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773871640, "uuid": "47bb05f1-65cf-4e66-bc39-8303f3f576a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871640, "uuid": "ada89ffc-c629-40b2-b701-52e2f5ae1a8a", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f10c872-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826827, "uuid": "c0354873-af66-49aa-8aff-fddbd8ebb23c", "comment": "Malware payload", "value": "8147b51676dcc8904e9a6432bbd6c922", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826827, "uuid": "64223f7c-65ed-403f-9637-0d4506d567c8", "comment": "Malware payload", "value": "3d8d28d570ce30fd4b80ebe986265c487aaf90e9f9d0199bf089c4d9d9c1093e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826827, "uuid": "ada97094-5e7d-45b6-a11c-21b15764c60a", "comment": "Malware payload", "value": "65738ea06457d02237d06d55362200e994bfe3fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826827, "uuid": "5ef38995-db10-4b29-b46b-97e1afc91cfc", "comment": "Malware payload", "value": "15bad3318d77490836b255a9cfb46528a6e2d2e0d679c0f6c18f4c6cf2a3e6d442198636904ab780e6dbac2ed4027432", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826827, "uuid": "aeb6ece5-67a8-4543-93ea-15442624c6b1", "value": "T1E7134CF61113ED9F4B2B0E41F40C1102ECADBC9372D954B8BF49469A4EE952C9EB8D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826827, "uuid": "48fcd836-ab61-478a-b20e-6d757f951b4f", "value": "768:LP1XDpGXNik3cUZvsSE+uRs2jBB33yHE9QQBj81shaG2sUq6SIcH+Vx:rxtGXNxbqCHE9QI81z7rq6SIcH+Vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826827, "uuid": "abb39572-77c0-42e0-93b5-b34fced76bf6", "value": 44376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826827, "uuid": "f8ce94c4-f075-4da0-bef8-84d0b58e9337", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826827, "uuid": "31164726-a213-4da6-88e1-75f770bf4a9a", "value": "3d8d28d570ce30fd4b80ebe986265c487aaf90e9f9d0199bf089c4d9d9c1093e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e741c3e-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827202, "uuid": "ad61c11c-d69c-4713-b27a-2c675b0c9cb4", "comment": "Malware payload (PhantomStealer)", "value": "69cc655c8f29ff199eddc7e132953498", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827202, "uuid": "7f69dc86-a2de-4599-afa9-8c1a1f06ebcc", "comment": "Malware payload (PhantomStealer)", "value": "409fcde2e465322e8edcf4498154e0962f120ea36abc087f854891a298f34fb4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827202, "uuid": "729e27df-c9d9-4d35-ba56-656c5ba51cca", "comment": "Malware payload (PhantomStealer)", "value": "c3e600fad07ecf5c2ea79a6ee439e2a15a050b3c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827202, "uuid": "027edca4-9baa-45a5-a456-a214dfa2a3df", "comment": "Malware payload (PhantomStealer)", "value": "b9da02b78c3ac5749aca8bb868ad2de1e5438ef7ff6dbec02f7b49a9d91192063aaf17e7c1f082c8b5d9180dc37281e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827202, "uuid": "9446778f-d627-4e6b-8514-bf62d6392517", "value": "T12E26AED2B4CA114AD73C767D04EBE3561962A1C1E6289AFD0CEC7EE8FDA148D508732D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827202, "uuid": "b2096a99-68b5-4191-a6a7-7ff2475f47c5", "value": "49152:pOeDynbILPKAJd1DPFsN6OToqmXML1rBAeo+R6:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827202, "uuid": "c8a1eced-962b-4b01-9b4f-34e24d888aa8", "value": 4575011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827202, "uuid": "0bc0f3f7-ef01-40a3-b941-279d67875504", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827202, "uuid": "d0b0c3b4-ee91-4f78-af8e-adb7e9477e32", "value": "69cc655c8f29ff199eddc7e132953498.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0094e7b8-22b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773828333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828333, "uuid": "9d7ecd06-a021-42aa-a98c-c7cd65c2a675", "comment": "Malware payload", "value": "7205a9e2b57180f9bb21e53f0b83288b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828333, "uuid": "7dbf0e99-8c89-459d-8448-bc62a7b37a81", "comment": "Malware payload", "value": "40abac7bcccaaf75cbb7e39f4718f0ef5e01926ac53e81047aa7901338d4795b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828333, "uuid": "813cf033-7b95-4544-9534-be8df9c10be9", "comment": "Malware payload", "value": "1ea7b10896fa9d830a7c264ecd9f51ac75739a97", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828333, "uuid": "54adad77-4219-4858-8557-dd4ce26dff1a", "comment": "Malware payload", "value": "dfb955d1cd856ce795d60941b71de7dbc99ef6457e97e970e5e85a24947edf56c4d60a9841f48a77256fca87927142a7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828333, "uuid": "6c229f2a-3c60-4a7a-be9a-140c2a4975b4", "value": "T19614F7AA627FC55E02DF02C1D303EED0DE72EA142B16ED759E91A8D752B21CF808CE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828333, "uuid": "83841d9b-b252-403f-99fd-cf8d97b060ee", "value": "1536:Daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaam:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828333, "uuid": "7e422bf3-aa64-4c7c-836c-dd007f21b241", "value": 196127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828333, "uuid": "a308d5c7-cd32-4022-9001-79df5a38f3a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828333, "uuid": "f766ed7b-2af0-480a-a860-dd56e88c74e7", "value": "PL10-03-2026L.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7342280a-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827237, "uuid": "2376d6ae-8872-48bd-8ece-043815875cbb", "comment": "Malware payload", "value": "d0c4ba539057b9937adae3a6004b35cd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "spark", "colour": "#1D7968", "exportable": true, "hide_tag": false }, { "name": "SugarSMP", "colour": "#B05F28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827237, "uuid": "bdc08916-dbda-4dc7-9675-a31890298f0f", "comment": "Malware payload", "value": "4152a790327976353e0eca6d99fe2d878069357fd9b6e63c80099c81519e09be", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "spark", "colour": "#1D7968", "exportable": true, "hide_tag": false }, { "name": "SugarSMP", "colour": "#B05F28", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827237, "uuid": "73da7082-a0af-4fe1-b6d5-754014721c9b", "comment": "Malware payload", "value": "983ab036a06b5cefdae510bf666126f6837fd303", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "spark", "colour": "#1D7968", "exportable": true, "hide_tag": false }, { "name": "SugarSMP", "colour": "#B05F28", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827237, "uuid": "1576ec9c-273b-48c4-b50b-4388e1621cde", "comment": "Malware payload", "value": "1c8f4557a848ac4e086ee79610eed2cbac19c281f2b963c334cf8db1c191185d6e3e618ef3b8aa090781308e7ecf3d7f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "spark", "colour": "#1D7968", "exportable": true, "hide_tag": false }, { "name": "SugarSMP", "colour": "#B05F28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827237, "uuid": "dc6319f4-3a12-4522-9b4a-5c14dfd5414c", "value": "T16547025A7DD6D229D647A47604A3C053782E91DDE48BD02B29E54C8ACE73C890F13FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827237, "uuid": "395e76d5-3928-4599-81e8-eda539420c88", "value": "786432:xj0pgq9hZ5YSkRV67cwmHgxzt0ZEGNRnq6:xf0hsx07cweIyZ9/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827237, "uuid": "62ddf30f-2be4-4a1b-b7d9-65624f805714", "value": 26806604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827237, "uuid": "bc4fc9e9-d28a-461e-9cfe-805aacd1a0b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827237, "uuid": "c8c8e945-a4eb-491a-8b97-b05313a7d9b8", "value": "modloader-fabric-mc1.21.4-1.0.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8280f286-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801493, "uuid": "2e37e869-62f8-4669-9db6-7c026b99be0e", "comment": "Malware payload (Mirai)", "value": "d49f0ef80584056aced8e19b7adc6f47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801493, "uuid": "1b54c0d8-eb2b-4a0e-a489-52857e8cd184", "comment": "Malware payload (Mirai)", "value": "422002ff0fad04573183055c329190ba308b810f9edc2474e2225d901dd0340f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801493, "uuid": "325107bf-c9ef-4eab-bb47-60beef0b11be", "comment": "Malware payload (Mirai)", "value": "2310808684aa1eb98580f0465f0b8dcc2f28aec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801493, "uuid": "a86327be-fd14-443c-b0f0-3fcd7f748576", "comment": "Malware payload (Mirai)", "value": "2c877b568edb2e924dc20dd3ec01c0c336f60596c3677aadd7aedcc7dba2270fe0a7d515f89969acfafe8d57127ed456", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801493, "uuid": "101ee1d1-216d-4e84-80f7-16718feba3bc", "value": "T16413F115E4F3C7E6F3E6B8380305CF77361B295B2BA975B458442A0CB5750980BA8EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801493, "uuid": "4835be9e-b68b-417d-88de-fd74f3b646a3", "value": "768:GI0BT2sZ7raUUbVHTron5UnF5Si5pAQIhJ8KCYcyP98ljm9wzLrbSxmeXx10MweH:GRUeHUZonagihYJrCg18lS9Urmx5f0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801493, "uuid": "ab72de2d-7ee5-4c04-8b1f-2ea9f0e65cf9", "value": 42892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801493, "uuid": "a5b97a11-1cb8-4375-957b-cdcc04846a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801493, "uuid": "d23c8ba8-c6e9-4c71-bdb5-9ee5377b29fa", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fee39b-2314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773870676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870676, "uuid": "656451c6-6bfc-41e2-b378-163bff1b4221", "comment": "Malware payload", "value": "e60d0d86abc287d7f5d815fdeaf104d0", "object_relation": "md5", "Tag": [ { "name": "185-241-208-147", "colour": "#FE6158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870676, "uuid": "68788439-2bc8-4e84-b946-67ca8c9bd6cf", "comment": "Malware payload", "value": "43db63abe68c53e3fe544711971eca4473c78f887f3e5a5cf6cf7d2f852103f3", "object_relation": "sha256", "Tag": [ { "name": "185-241-208-147", "colour": "#FE6158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870676, "uuid": "a0c3ca44-f24f-4da5-a0a2-df96421bcf60", "comment": "Malware payload", "value": "b3d1d05f0a08bdce5e14fe211f01920c61905bd5", "object_relation": "sha1", "Tag": [ { "name": "185-241-208-147", "colour": "#FE6158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870676, "uuid": "c9806db7-da1b-4686-a020-11ebae952609", "comment": "Malware payload", "value": "98d192d64dfc4ad9ce681c6c047f2c1921e93e26a725fee13e0fdabfe825b781dac1ea90f38d001c2c2199d1075c0e15", "object_relation": "sha3-384", "Tag": [ { "name": "185-241-208-147", "colour": "#FE6158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870676, "uuid": "1b2e3553-db9c-403b-9df1-060372b9b508", "value": "T18D1833940BD81087C6AD5F3F6D92BCAD8AE846DC2C4B7DB522BF5384B565F4F0E62024", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870676, "uuid": "0be3e4a4-c8d4-493e-9554-0221fd31e65e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870676, "uuid": "11065bfc-ee6a-47ea-813d-2af8473cc212", "value": "1572864:t1YqPsDQQ29xyzC31TM+YOz2wR90wlHDIJF8+/qpatCj9RwSMlL7LLiVjtTKiV:tZPsDQzEzqhouxR9PljIJy+Aawj6v+j9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870676, "uuid": "ed58fbb3-29e3-495a-bfcb-874821ca7fb8", "value": 87518147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870676, "uuid": "cbda90e8-1397-40cb-b3f2-102d8adc2dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870676, "uuid": "b3d9e9f4-0bd7-4b9b-a866-ef4fe7cece35", "value": "8cdedf0b4d7d8946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d078c08-2315-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773871116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871116, "uuid": "84bb8709-2058-405b-86b5-642941eefece", "comment": "Malware payload (LummaStealer)", "value": "1f5269a808d5aca4309344c88a54c969", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871116, "uuid": "b3e622d0-9261-4aa8-a42f-f8780b5c7b6c", "comment": "Malware payload (LummaStealer)", "value": "451df865bc2a2ece0303ef939f5c36a1162ab87df6ce4b366a95bd32c5280710", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871116, "uuid": "3ce9132e-4ae4-4ba9-a7ea-2a31cc7789c5", "comment": "Malware payload (LummaStealer)", "value": "bb0baf3ebe99980cfd6a7e24367e7b0f9b2114de", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871116, "uuid": "7d2bd29d-8498-430f-b83c-9a089e8f8e49", "comment": "Malware payload (LummaStealer)", "value": "a1c6d715461efd071fdfcf16f5220b9de9f80de99e503eda071e17deb169d3b88ac9e46bffdef91b47c6532855a52571", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871116, "uuid": "cf8da3fc-edba-4553-8e6b-46a0250a1205", "value": "T1209501937C4443F9F439CEB3F47F06135E717E3B865409AA11C4BA940DE7A82A62EE25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871116, "uuid": "c9700a9c-1781-44bf-9ffb-7b394f5d7202", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871116, "uuid": "d04ef129-661c-4438-ba6d-212fc7ed3638", "value": "49152:Rxk8SWfiokHWrK7OHGRtTDw1IHF9DfZyTfc1KIQ9:Rxk8SgAj7OHGnT4Wj1yTfFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773871116, "uuid": "71d82534-8a7f-42b1-b760-3f96dc0b9117", "value": 2050560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773871116, "uuid": "0954f8bc-bc95-4b99-8050-17b291d228c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871116, "uuid": "f0153d9a-f50c-4d46-b503-f0655c789a77", "value": "2CL6ltVxxKjIP8befmKf1ikP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4add6ba1-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800970, "uuid": "968b0bdf-11e8-4a23-aa4b-075671ed8c5a", "comment": "Malware payload (Mirai)", "value": "e0c6e4b6ea11ca286dc1a463726a118e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800970, "uuid": "12cdbdd1-e9e4-4805-af16-da82cb446d1a", "comment": "Malware payload (Mirai)", "value": "4660743ba631ff4cb2326f406edac1eae6829e00051e843a90bb46bba5254302", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800970, "uuid": "0b4587ec-c838-43d7-bf06-fe2b3e2e3bf6", "comment": "Malware payload (Mirai)", "value": "f375d3d5ee2d49819371500437df4fba7cd94984", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800970, "uuid": "b35e2f2c-f69f-4f5b-ba59-656b9ff4378c", "comment": "Malware payload (Mirai)", "value": "cbc709d61578a250bc43e15fa1e2bfa338d9b9c7d057187a8477d8549d653d0aa66f611cf38b2e39bb70e6c341dedf63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800970, "uuid": "fc2fea25-9dc1-4043-bc77-09b0d3e2f78b", "value": "T12613748CF86A673EC3E276FFE78857CE327A07C8678BB626C635025537C9304A525914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800970, "uuid": "86a56e01-c0f1-4e03-93cb-a15cddf46cf0", "value": "768:NOsRsKhc7Il21V32A89OTq3nEQBn3Ovb4e63FxicBjkcoBHHHHHHHoTn0:gHMc7+sV8qejBn+0nDNSNBnnnoTn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800970, "uuid": "b86c4a7c-c262-44cf-871a-00c7c12eddf0", "value": 43287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800970, "uuid": "1db64ba3-97cb-47b5-9aa8-50daf9b02a89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800970, "uuid": "78b5c39f-0c88-4171-a3d2-a93aec3a7490", "value": "dontcrynow.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4016a982-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800952, "uuid": "f3f195e6-b16c-4c08-b9d5-7ee7ce0d1919", "comment": "Malware payload (Mirai)", "value": "dbc15f84b3f2300c9788f58aa2e79ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800952, "uuid": "b3bcd4d8-c9bc-40c6-8a37-8cf0e7f476fc", "comment": "Malware payload (Mirai)", "value": "46dcd95e5b1f0b36a45e0a16a8513e082d23efa6d695f4702ea7e1ad79236c17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800952, "uuid": "20db6cfb-c6ca-477e-be6e-a0cd283929cd", "comment": "Malware payload (Mirai)", "value": "435b027d7c7371f891a565026a8c4a392feacebe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800952, "uuid": "d5aa580f-09c2-4c5e-a3b4-5d981d094261", "comment": "Malware payload (Mirai)", "value": "cd0132c30b3a74fd6f4a7425403ebef4b7c2e841f46d291f0e1d5fcaca786f053a36c62fa40f427ff4571bc7a5e21064", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800952, "uuid": "04a57669-6c55-4734-a7aa-d8bbdffe2294", "value": "T13BC2E171D1DAAD21D2B04878B99281CB1B430FFE89AAF17978520B2CF89B40510F4B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800952, "uuid": "14b08d31-aa71-4a1e-9d79-1a66c0ed26c4", "value": "384:7lR/kG6sV882C6XQp4qmm5WjhE9ve3nVUcH1p1COwzhaMjBWvShymdGUop5hpm:p5kw8q6XdqmcWjhJn1zwEMgSs3UozLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800952, "uuid": "bce3f78a-18ee-4b0b-98f3-2591cf58c79c", "value": 26796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800952, "uuid": "32dcff9d-88fa-49cd-90f6-278a226d6d34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800952, "uuid": "64c0cc2e-41f8-4f5c-a73f-378fd59c87f3", "value": "dontcrynow.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f358fc8-22a7-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773823767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823767, "uuid": "3b892c8c-bce2-4224-ad51-999d603f0816", "comment": "Malware payload (XWorm)", "value": "7243336767406d7c724c6a41d6ef44f4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823767, "uuid": "edeeadaf-619e-4b94-ac07-74194ab6b563", "comment": "Malware payload (XWorm)", "value": "4727b6657618f21325ac0e5b837f1b54cb0751bf97ec87796cbb06f6deabd014", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823767, "uuid": "501aec8a-db1b-41c3-a434-8023c5724e1c", "comment": "Malware payload (XWorm)", "value": "a88e48edcc816b5b048f5408854c200e6b28c90d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823767, "uuid": "63d772d4-65de-4277-bb8b-6c7347490cbd", "comment": "Malware payload (XWorm)", "value": "01ee54b5ef946626f2f511fe02e4a1ad22d9a77bc509d04a27a21ab1962394dae16ccc07c0682cf3c26566e9bf2b81b9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823767, "uuid": "c114218b-fa20-4c38-8cf9-77f5c4621816", "value": "T19DE0AB14573A310F499A85A6880D91DAE69DE2D8133B7AF779C8BC8049402CA7AAF18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823767, "uuid": "aa61a054-4265-40e6-9d35-01af4a9e4b98", "value": "12:wbYVJ4JF4do984CXLgyaIS1PKC2ALFyGHDfhHXQ1MnGHXbk1N:wq4j4doEXLw1PKC2kFHDV9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823767, "uuid": "19754354-cc3a-4a69-bb3e-2def62514e9e", "value": 421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823767, "uuid": "ab4f3482-be76-47e6-aa35-df9f6055d558", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823767, "uuid": "3754839d-80e6-4f59-b98b-7d12952c71ff", "value": "MEGO-BAT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7fbf68-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800949, "uuid": "9d137667-f3f5-4ab9-8ab8-dd1d46d31458", "comment": "Malware payload (Mirai)", "value": "5af5ec59e1cc23373097ec583c2c2444", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800949, "uuid": "2d8fa1fa-1166-4897-b5ef-b2763de652af", "comment": "Malware payload (Mirai)", "value": "48881849ad56486002fa0999bbcd05d15cda932189e129f0f711f43b4a300ed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800949, "uuid": "6a1a2306-6bab-4f8f-b590-2695c01724b1", "comment": "Malware payload (Mirai)", "value": "9336f73533f42b99a6e956224a09b7a6b7612d56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800949, "uuid": "6cc7b899-39db-4f6a-81e9-67e7bb4e23dc", "comment": "Malware payload (Mirai)", "value": "c73a37d84976288f2eab4fb806b186a28804d5fba2af46a28558f659673d8d4273621b8b7bfb5683b7275bb012905812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800949, "uuid": "3ab40ac7-cfff-4744-aefd-7adbd5b52e52", "value": "T1EB432A31BA71181BC8C5987A62F74365F2F5478A24BCCA1B3D720E8DBF64640735B6B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800949, "uuid": "7f973db0-48a9-45ad-8685-3f408f67e949", "value": "768:rY6kpWPXYgIkss7FzcAk3IfTO+lgG5V+lld01tcoIz3:rY6CqOfs7FzKslh51tcoC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800949, "uuid": "42d3cb2a-6850-4fb8-9ef2-0349dd862877", "value": 58752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800949, "uuid": "f50ac84f-7183-4508-9dc1-3256735445a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800949, "uuid": "8f9849e4-fa50-4833-8870-accc3a85fa6e", "value": "dontcrynow.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba21c965-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773825208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825208, "uuid": "72441c2d-2ede-418b-af92-c5e9604471fc", "comment": "Malware payload", "value": "43db7e38ddf8427b857dfd155e6ab549", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825208, "uuid": "623cf480-1fc7-45e8-92d6-57fe98f8ac2f", "comment": "Malware payload", "value": "4930af3259f2f4daac6b3e9da92473226c11822ace1ca7964b9064887f41eafd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825208, "uuid": "b7a2d6f8-ae49-4c81-b731-9348cb5a3f55", "comment": "Malware payload", "value": "fa22495cda144d77c51be1612c5ddd1693bf554b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825208, "uuid": "ffeca1ca-a497-491a-ba5f-57f1568cc97b", "comment": "Malware payload", "value": "3b09d0e1601ded4fdbcd84ce2cb24d577ed934d20a2af2fdd576706cc1c5e4b1afaf38d6be787aa0e30d651034ff1d3a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825208, "uuid": "a799cd77-d068-4125-809d-3a98a2c47270", "value": "T12EE4237DF9D6CE41DC5B7D3048C4816D258AFC492F19D98B305AF3AE883A5A352832DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825208, "uuid": "d9b0a2a0-0478-4f62-92d9-99a6d16f9ade", "value": "12288:EwgZJmp+f9Ks2l+jOENgZJmp+f9cHMDBR+wKG2tbZTa5KL0HWo68m4guyJJ+:hgZUpaKs28JgZUpacHMlR5v2tb4AoV6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825208, "uuid": "c5fe5ff6-834c-4b0b-8989-8e7313a89c85", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825208, "uuid": "cd4f2a8a-1070-45f7-8200-3c844bfafcfd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825208, "uuid": "157120ea-c29d-483c-92b7-4ef0e5f3b7fa", "value": "43db7e38ddf8427b857dfd155e6ab549.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cee3b3-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773827021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827021, "uuid": "77aa1d59-0696-49a2-b5a9-2ad701552d0b", "comment": "Malware payload (CountLoader)", "value": "3e788d2ce7d9f919da9b6d978040a4d1", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827021, "uuid": "9c64bb04-1dd9-4eb2-946c-b40ed33e4958", "comment": "Malware payload (CountLoader)", "value": "49319dd9cc4c19c9a90a91cb12a23e6de8a9052d5123992074affec6c6857ce6", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827021, "uuid": "c4fe3742-1d9f-4cdc-93c2-2af82452cd3b", "comment": "Malware payload (CountLoader)", "value": "3d9fc15b1ba92d8897c3abe9c10f8a044e720170", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827021, "uuid": "f49c4bbd-3076-40e0-8725-42b80e51c8c2", "comment": "Malware payload (CountLoader)", "value": "fe4618a6b5b86dc07acc2380122724ae7d9cb805698c58ede9ea8de4b0b2487716b6f7cf31b77bdd183c27a7de9c330d", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827021, "uuid": "7550b019-3331-4bd6-8c76-fb1cb4ce9a4a", "value": "T184B3008A4A8E80EC8B9BB424DD4F9D07DFC95606070DC5617B5FAE032F72C74A2E95E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827021, "uuid": "5cb63157-5109-47c3-9796-d1af14591145", "value": "768:wfuLbuyfboocTRbVb0xl/Vezf6lI79z+GRHL7jZQSjs387L2iKOZZiw6lStpB9ec:wM6ukoaBe9+bt6KTekZVUUw0ipo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827021, "uuid": "e9474068-459b-482a-9328-5ca66c5f24c9", "value": 112940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827021, "uuid": "712a28b8-a511-472c-a511-45b3c9d753fa", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827021, "uuid": "247a88eb-f962-4230-8977-30280112d5d4", "value": "User_Photos_Old_1737.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e317b3d8-22d6-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773844175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844175, "uuid": "aa5f58df-f857-4e43-a5f5-2c0a1f52b8f9", "comment": "Malware payload (RemcosRAT)", "value": "03498893859aa4ce8ef6070e2d39bf94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844175, "uuid": "cb4862c4-6232-4126-b76c-ebe3a1e05c53", "comment": "Malware payload (RemcosRAT)", "value": "4bcb31282f269295b1e6cc0ede73829d022c11aa794eab02ea5a6bb54ed17c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844175, "uuid": "7fc2b421-5d77-4dc5-a417-79dceeefdbcc", "comment": "Malware payload (RemcosRAT)", "value": "90bcc6737059222360387544030b41489535c127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844175, "uuid": "b17f1e41-eefe-4bf4-8bd5-e3face5fcd83", "comment": "Malware payload (RemcosRAT)", "value": "91f4c279e09f28505dc0f5c5f9f6a342e612688ae744400d96d167e5f13219fa1b53cd5c300393b9bc54374bb4f8ce87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844175, "uuid": "f8b67d69-6fc3-4400-92a9-ad3aa659d3f1", "value": "T196667C0A62EA41E9D0B6D138CD5745AFD672BC514B3297CF0171BA0A6F3B2D08E39736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844175, "uuid": "f7662554-d1b0-4c61-9beb-2c1b1bf7c543", "value": "257670f56ff8877f9177ae6446e88b54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844175, "uuid": "038569e6-4276-48aa-ad55-4176ef7e5fe6", "value": "98304:vLRwVnV9ctO4GqNL5Hnw9qLGUqk0Nyzp0BMJ:lyctO3qNL5HqPk0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844175, "uuid": "83f3aa51-2ce4-4060-99be-3f429e2b87d0", "value": 6885944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844175, "uuid": "26672299-e436-49f2-a0bd-8217784de2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844175, "uuid": "abd46ccc-9445-427d-8f8d-b00a8c360ab1", "value": "x4bcb31282f269295b1e6cc0ede73829d022c11aa794eab02ea5a6bb54ed17c58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0019f6-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773826498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826498, "uuid": "f0b9651b-40db-45e7-8fe6-2a85b5e2ed88", "comment": "Malware payload (XWorm)", "value": "939bc6c2c3c865d9bec982db1aacd97e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826498, "uuid": "8cfe0de3-d412-43dc-9133-3715b969c117", "comment": "Malware payload (XWorm)", "value": "4c3661ed10a408d0cb49bfe952472737e3ade90a153eb19cdf02d43865d36866", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826498, "uuid": "02745544-7c34-40a3-9cdc-a982752f241e", "comment": "Malware payload (XWorm)", "value": "7c10e23405c0d8decde2bc461e8590246d8b1a27", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826498, "uuid": "a9824d18-e710-47c0-b90c-0af160f58f24", "comment": "Malware payload (XWorm)", "value": "d29188d7b8bb2d3535103eee8e566f9d43507b08eb39d2dbe7a511fb9592fac10e333118011f70e2349ad97edefa0582", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826498, "uuid": "7ca439fc-00fb-4a80-8f3e-4bcf1284291b", "value": "T11185688769B85369DDE38B8F8E474B03DF411CFFA8219D2998BEDE43D435D8A0768460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826498, "uuid": "2b80ea64-972b-46d6-b236-18c39e46696e", "value": "768:Cm7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7m7R:Vvi9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826498, "uuid": "e8293798-8c9c-4c78-a748-2a0e3511a67b", "value": 1799932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826498, "uuid": "56825447-d9e5-47d5-b4c3-45546880cd4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826498, "uuid": "5350193a-17c4-4478-95f7-d520c266c0a1", "value": "939bc6c2c3c865d9bec982db1aacd97e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66b26df-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827403, "uuid": "43d28577-7d65-40e4-9a19-01f5cf68db18", "comment": "Malware payload (PhantomStealer)", "value": "1faa06e883362d39ba5469d249654736", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827403, "uuid": "380db6eb-a327-4cb4-945a-05127a7783ad", "comment": "Malware payload (PhantomStealer)", "value": "4e025ca628449bb57f89cd3ce96958eeb2de69cd8390b93498bf596dd7a15b9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827403, "uuid": "947c0080-6bae-42a6-85b3-e491edf3ab33", "comment": "Malware payload (PhantomStealer)", "value": "effbd1541cbfe9079cc5c3eda7405bd142722087", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827403, "uuid": "a245dac6-2df7-483a-8e25-cd511bca60ce", "comment": "Malware payload (PhantomStealer)", "value": "928de0cf00044b521f5ddcc25a707cdeddce217463e0d9825675037bbe95657cd9f8a83c1a1b31a9739024f3b1758c6b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827403, "uuid": "71f610fd-3477-4f19-98ac-6c55a3783fb6", "value": "T1E8C2979D3EC3B1389225A0F36927A0667A6D9CC47308C456FBE758DCB92C334E175A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827403, "uuid": "e8203d0d-38a1-41a4-b0d3-11707d906fd6", "value": "384:VN+cDppmOXtQII0YeMKWmamyQMwv4d0gu2dins2aOifoDlLIpE1m1NkGX1e1q8:b+avmIfYAWMvs0gRUselUxtgA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827403, "uuid": "4368b311-5be7-4636-9164-289890404daf", "value": 27966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827403, "uuid": "d83d11ae-431d-43df-a6fe-77cddb0d74e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827403, "uuid": "7f388c99-22aa-4c42-9814-5a2730b1edfc", "value": "1faa06e883362d39ba5469d249654736.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e136b400-22cd-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1773840306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840306, "uuid": "9a15bf6d-5df7-4aa2-911b-7157d7030dea", "comment": "Malware payload (njrat)", "value": "5558c796a7a6e106761d82f0f26b1d45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840306, "uuid": "fb9fd684-85b3-4d54-b6ae-7e9b5301f704", "comment": "Malware payload (njrat)", "value": "4edc7981542ff530aa6708a8df8f9123335d77d51d4ca3e2b7d0c7797b0926b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840306, "uuid": "a0e0f287-3c34-43f0-adb4-14fd56a8e494", "comment": "Malware payload (njrat)", "value": "ad48bfaae7ece8cfdea1ac02d0a0b80a4539b1ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840306, "uuid": "c646a162-f7a2-4c7f-a5f8-e3f48ebded21", "comment": "Malware payload (njrat)", "value": "bdcff061e4dc5230d6001d5abe8f57cfb2da2a310d39c7b07ab687e4ff6b59d0510e3b63d4a6d4c1626b116b8347b6ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840306, "uuid": "88f9bbe2-2c4d-453c-b811-76e96f30e2ec", "value": "T13D432844BFEA4A01E2BD8F3469F655150634BA63E532EB1F48D668EB13327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840306, "uuid": "d33d6401-854c-434c-9f7d-59fba4fe0b96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840306, "uuid": "0b33dfdf-13b7-4c9f-8cae-88c555bd044d", "value": "1536:Vwjs4DnAN7jytFADRwsNMDiXExI3pmDm:aI4DnA2PADRwsNMDiXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773840306, "uuid": "21a78422-5caf-4d46-a237-bfde63d80d42", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773840306, "uuid": "9c54ed6a-a8f0-4f13-a5ae-b58b08b8632e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840306, "uuid": "f75fafa9-7e24-49bd-8837-939159c4cadc", "value": "Fortnite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0a1ce6-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773827171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827171, "uuid": "34448863-76d9-4e12-93c2-1165806c5bd3", "comment": "Malware payload (XWorm)", "value": "d3602ab018e9bafd4de2b8d024a29f7c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827171, "uuid": "0b9ea6f8-85da-46f3-a1d5-f704729249d8", "comment": "Malware payload (XWorm)", "value": "4fcffd5b8f6c1c9aee777ccb7fca8d9306d218ca2ae084a43cb3f370f4dca280", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827171, "uuid": "9c96854c-2c3b-477e-9433-8576899b15b2", "comment": "Malware payload (XWorm)", "value": "1b1cf837a791c4a757077501228777eaf48023dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827171, "uuid": "322c1f99-2913-4adc-affb-125024ad9c64", "comment": "Malware payload (XWorm)", "value": "4df5629c25bb93af6f4e84c504d0ead23ad474da3c2a99a258cae3a0431f852137265561978858fe04a5478f83daa85b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827171, "uuid": "6c8282cd-e7f4-4c2d-b98a-aebb59f47d6d", "value": "T118350219F61B0AA0D17F94E2049DBB9BCD5A2119F543203A31E391CEBD279AD12E377C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827171, "uuid": "b02fd1c1-3df6-4ed4-820d-be461a55b22e", "value": "192:dNDdMc2jrixTQ6LpA1U0eQLmDyDyty92qyXY42BF3YAM6YfsWKfuMlpiZWu4rA+l:dNDdM20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827171, "uuid": "b46b7300-bde2-4c1e-a04b-8b1f866874f1", "value": 1113117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827171, "uuid": "04071225-b0cc-45f0-ae33-5add920da7db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827171, "uuid": "3ea1820e-7a57-43df-94a3-4c6e35b1b316", "value": "d3602ab018e9bafd4de2b8d024a29f7c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccfe924-22b5-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773829669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773829669, "uuid": "1e46b32b-d128-44f7-b750-ce0481f1eeac", "comment": "Malware payload (ConnectWise)", "value": "4bf656dc752f5748589a9f8038dbec00", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773829669, "uuid": "8b039596-6ae4-4812-ae9b-097907d93873", "comment": "Malware payload (ConnectWise)", "value": "503d5d51fab6944c2c18cc81c3aa7b5c0d21bc5df417a13894630b41c05fb71a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773829669, "uuid": "b54b1847-fe3f-473a-96f5-5db3adbea8eb", "comment": "Malware payload (ConnectWise)", "value": "4c8c157e01758115f1c38bd6ec077a529bce5cfb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773829669, "uuid": "da13ce00-024b-4557-985d-906da52d54cd", "comment": "Malware payload (ConnectWise)", "value": "d7d75a75f8a8c8d98eb5604e4d8e7acaf55bbd55077664b16af7aa677bf64b2bf6b43a2353b262803f397c0c38000655", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773829669, "uuid": "46aa8b91-e07a-4f30-b792-3f55c1885037", "value": "T1F0E61201B3E69574D0BB0A38D87E9266AA31BD004716C7AF5794B92D2D73BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773829669, "uuid": "aa536b01-0b78-43a0-a9a5-d3bccbc75598", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773829669, "uuid": "3fb95127-ef4a-4d09-99e3-79ad81ca797b", "value": "393216:kgdEEijHDGcgdEEijJgdEEij7gdEEijggdEEije:xuEl5uEduEXuEAuEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773829669, "uuid": "c59af638-f7f3-4fe0-bb12-eda8f0a50225", "value": 14750776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773829669, "uuid": "b0575413-2208-4ab0-b794-f6d8c1112e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773829669, "uuid": "da1da477-e3e9-4846-8bee-7d913652b581", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09fe24e-22bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773832601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832601, "uuid": "c821651b-2adb-4a5c-8f29-19e60dc28199", "comment": "Malware payload", "value": "6380ac00e3b181308ed5c033aef70777", "object_relation": "md5", "Tag": [ { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832601, "uuid": "b9df4917-d27b-4a23-9f3f-e24ecb782fd6", "comment": "Malware payload", "value": "5075629ddefbf08fbe8f75fb61007ef8ca5c73a146d9832a961b5c0b5832f96f", "object_relation": "sha256", "Tag": [ { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832601, "uuid": "35b940bd-899b-40e3-b0b5-5b5e2f8e64da", "comment": "Malware payload", "value": "070bd90e1c9d51516406ab9a19c78055e4abd5ae", "object_relation": "sha1", "Tag": [ { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832601, "uuid": "69a28d2a-f55e-4584-a4cf-93bcbcc4e58f", "comment": "Malware payload", "value": "5bcb4519a361292d5b847381d20d1d735d172c4053c44d18fc4b787654d0def4b751e383988c239a92263ab2e9c23de4", "object_relation": "sha3-384", "Tag": [ { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832601, "uuid": "68b69032-30c3-4bd2-b548-d850a847000c", "value": "T1AE961211638AC276E16E01B7D82DEE0EE1357DA7073141CBA3F4B99E2E724C1567DB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832601, "uuid": "0193e3b7-340b-4cab-a3e2-3e8469dae6e6", "value": "196608:nylQ21y5xC75LBWSyFNm9byLVvOi1bNejQSt4kA7tr:n121y2FBWSyFNjRvYjL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773832601, "uuid": "13e16ef5-5715-4efc-a36c-ef71555b8dc1", "value": 8882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773832601, "uuid": "fd56524a-124f-436c-9de8-d5f7745fa2eb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832601, "uuid": "5ce02bc3-270c-4308-ab94-5051950a79c1", "value": "Dwglq.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623bca72-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773825061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825061, "uuid": "1af40d7e-1ec5-4126-84d8-16d8ea106b84", "comment": "Malware payload (Vidar)", "value": "1b31af992b23785aff18b419dd64d9e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825061, "uuid": "5ebe503f-98ee-45b4-94d7-f36c29608234", "comment": "Malware payload (Vidar)", "value": "50ce979ff92c443be2c6424fed8399263c2ac9e6952ef6f77037f6556ce338ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825061, "uuid": "307680a9-0312-4c0e-8a72-0f547affbddb", "comment": "Malware payload (Vidar)", "value": "6232e64b5c3f455ffc7429bdc661668e172e84c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825061, "uuid": "76c88b55-e28a-4008-b89a-5ef6f73fe457", "comment": "Malware payload (Vidar)", "value": "2f88c9d1b25e59ff21081944c3049fe8e106044a0526cf8ddb0c806141e8ec378d435ace9628af8bbe23ea3f8febab4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825061, "uuid": "4dbfa8d3-a6a9-49d9-a87b-347056d17bc1", "value": "T18C547C1091108031F3341573D65DA6ADC99F9AB22371F4CB6BA6287DDE259C2E339F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825061, "uuid": "c46a6dfc-9c36-40f3-ba29-625b75ed080a", "value": "bcf77c2c3cd3748f83f9c44cda23fdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825061, "uuid": "52f30d43-654a-4008-9365-2be77c12efaa", "value": "6144:MiKNqzy8JFjVSZSJOyBiCmL5QZPNKNSQ7+STtqR9YjgD6vizk13Kb:Mi+q9I92Q1Tt3xvOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825061, "uuid": "df3ae771-cf52-4334-acea-3955d3ac959a", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825061, "uuid": "c2b5932f-2444-4607-8947-fa7486b26c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825061, "uuid": "090ea584-26e5-4f82-9788-c415fbb28a4f", "value": "x50ce979ff92c443be2c6424fed8399263c2ac9e6952ef6f77037f6556ce338ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026f172b-22a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773821464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773821464, "uuid": "01cacfe2-2241-49ae-96fe-4d27ad54c3f2", "comment": "Malware payload", "value": "8165f21c881fea2f8ff6241028882067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773821464, "uuid": "ec83dae0-0209-4319-af02-3a376d456043", "comment": "Malware payload", "value": "51cdefe04285314e5531f5bc12fca600069ed309760d04aacf41b43d80694cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773821464, "uuid": "66236cf8-a34f-4d15-b70d-20101b43ba0d", "comment": "Malware payload", "value": "4e19c65039f67a0f215cde0a019d9117a8dca74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773821464, "uuid": "ffc02667-5762-428b-8ef3-c204351413ae", "comment": "Malware payload", "value": "ca82781896fd77d4401ecddc41e8a0c061b491fd4c75bf8efe2e84fcceb5cdc54c87acaf89f8408497acb4c0b6ea9791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773821464, "uuid": "a7b9eb78-1609-432b-9ceb-59474e90c1f4", "value": "T1C066F101BA52B12FCFF52638A92EE61C8C7D7A103CA45C1C3FA41EC94A3BA517D75287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773821464, "uuid": "2c2546bd-7a37-478e-951d-64141cda3416", "value": "bf8d88fb7815175dd959fe045f668096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773821464, "uuid": "72d341ae-ddfc-484e-837b-ad35afa99201", "value": "196608:piKFIPihRrlfXV7MOWOrx5lYXU4lVz4zCuRLJpei:plFqur9F7MObV5lYEGVmFRLHei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773821464, "uuid": "1d20f419-bc82-468c-8149-8c796166c67f", "value": 6945792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773821464, "uuid": "43f88888-a2bb-40ee-9acd-62fbfd75096a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773821464, "uuid": "59844144-b756-490a-bf91-56fa9f336b8f", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcfa867-227c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773805461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805461, "uuid": "045fd3e9-e471-4fbb-a1ff-666f0eba3d00", "comment": "Malware payload (Gafgyt)", "value": "9f8a3c5d270d83b33ad96fbb8929603c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805461, "uuid": "623674ba-1474-4fa1-ae57-9e4941e4e8ce", "comment": "Malware payload (Gafgyt)", "value": "52dd7821809a226cb3b6a3e17ad9dd4833872b950882ef4c4b2fe0e3ca8f296a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805461, "uuid": "25b32a73-eea4-4ce0-ab57-71e930708bdc", "comment": "Malware payload (Gafgyt)", "value": "7eb0320b682794c7f564a65370800f89487d9d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805461, "uuid": "de4cf681-5d37-4e59-9bd0-dbf85eab6f6b", "comment": "Malware payload (Gafgyt)", "value": "5767ec6f57fd01dfd29e50090d246611a0d47651b8869eefc6451181de50583bd8f683fd61fbe0cfe78711f6ff30c92d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805461, "uuid": "66df9ef7-a62e-4c69-8e18-4e3d2742adda", "value": "T115443945BE405E37C7D0667BFFAE42CD332627FCD2EA3202DE015B25369A45A0E3A552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805461, "uuid": "f08a198e-4dff-4e5e-8b95-620ee3cad206", "value": "6144:6RGlUYz0E+SlRZeFAwvmgQjH5LjIdrwK7iYmPTM8LVyFv+WHPlWA7vC64B5Rlwkm:HUYz0EBR0FAwvmgQjH5LjIdrwuiYmPT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773805461, "uuid": "d259a21f-e5d6-4019-adf7-6d65b42ba852", "value": 258328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773805461, "uuid": "cbc32ab1-0ccb-4a28-84dc-45622f3285b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805461, "uuid": "9b500558-ee0f-47c7-b792-e5291ef5d360", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4a5731-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800945, "uuid": "9ca0d9b3-de97-427a-a44b-f5db07bd79d9", "comment": "Malware payload (Mirai)", "value": "1bbf115119029c3412904af99611f3ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800945, "uuid": "90292650-59e8-41f0-bc2e-a7a1e39c6d97", "comment": "Malware payload (Mirai)", "value": "5374977ec8c1c386863c96881a310ee350811ae057849c69f35dca1da69acbc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800945, "uuid": "41ed63dd-2778-44ad-b712-e9883f7f39a7", "comment": "Malware payload (Mirai)", "value": "ca0c804db786261c0bfa43e4056d7e70e677de3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800945, "uuid": "00c7a30a-dfac-41ca-b23d-97a8473ada52", "comment": "Malware payload (Mirai)", "value": "70b1b80558755f7558c861d80ed8e4566691c83ade8148fa4faa42b726de47a6451afd49a4d4004ba005a04fc0c3c4a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800945, "uuid": "e59d02b1-47c7-409c-85bc-994824342a58", "value": "T1AF62C060731BB832C7F25878FD5CCDC73F0726F490EA2A69A30045A85DD7211E9BA687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800945, "uuid": "8b58e82e-49ff-47d3-8ba2-8b36d0b54403", "value": "384:A6aPyEq1pvkZKWOj7n+R1hh7qmdGUEpiafMxl:Lzf8ZxJLh9q3UELfMxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800945, "uuid": "07e21110-c9a1-46ef-8211-bac51010c681", "value": 15928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800945, "uuid": "5ac638b5-e19e-44ff-a9d7-a53839fbed92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800945, "uuid": "1a0ac2ef-0a59-43dd-88ad-126a6ef61038", "value": "dontcrynow.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21245de0-22a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773824093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824093, "uuid": "7f706712-b8f6-4aa0-8001-a599ac719643", "comment": "Malware payload", "value": "2b5fbc8947759cd8288bfc0f37b85fab", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824093, "uuid": "748f93ae-7494-4c2f-9c7a-2e4754f5b052", "comment": "Malware payload", "value": "53c61dca7f78a31eb22f07aff04626979c1910e4844ebd64ae0b43cce02331b4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824093, "uuid": "0a41ba0b-6d55-4290-b2a0-8af5f423f1ea", "comment": "Malware payload", "value": "876f90473a0e7e06ccd640596c69d82aaa6f782e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824093, "uuid": "afcbfa27-af78-4eff-9c1b-d0ac15369919", "comment": "Malware payload", "value": "63ecdaae9ab17515f081d5b5bc9b82ab2afa9d8a58e85d875e8d5c6e12e3451d3052170e0a9e772b96af532366a28588", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824093, "uuid": "c42a1085-16b2-4f39-9794-557d6fdd0b67", "value": "T14421E17A27B41F0F0B879A1C00AD7300762173154E1817C1BBB9C6527F8A68AEA6AC0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824093, "uuid": "f17f0572-4a5d-4428-9f3e-276a44a2fe63", "value": "24:e36J5l1lH/X1VXftzqzrIqG0nOiWsOZIRKcKAKCBFKUKnz:eqJr1l9WJV+IRfjDH8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824093, "uuid": "68f83745-420e-4aa6-a9cc-087460a34f8d", "value": 1370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824093, "uuid": "0c764981-3531-4ae4-9d9c-9752a20a90f6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824093, "uuid": "f2ed44b3-ef95-4395-9357-698b61a5c62a", "value": "bsod.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fa5a26-22fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773861229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861229, "uuid": "25859915-0c07-416e-be13-44744ca426df", "comment": "Malware payload", "value": "4713489964a85c720a9b665e721e26fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861229, "uuid": "490121ce-6653-456c-a7fc-69fa7cc18024", "comment": "Malware payload", "value": "54627c7d40bac1bb85e7b287e877fb7e3016772d552649456d35da938aa39704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861229, "uuid": "bf39d681-6fe0-4a71-8b6c-6fdd6e2921ab", "comment": "Malware payload", "value": "0973300006645f575667e09be96d168d100e9cce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861229, "uuid": "c9cb4b3e-ca43-4a06-9365-d1e777b284f8", "comment": "Malware payload", "value": "38202bfb2c5c1fd1dbb5429bb9751df97b33a5c4f31c15c4bbbd03155411d781366afcf9baeb26166f75f3c078cf40f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861229, "uuid": "92d584a5-c361-4884-af6e-8c08b05fb7c6", "value": "T1DC859EE24194A71BDC35F3747D14B8A11CFDE69732AAD6640FE2BEC1AC9C069CA18D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861229, "uuid": "be76e85d-c025-472d-868a-345edca00a91", "value": "4a66de3e8d132708eb41ffa0ee63c649", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861229, "uuid": "bd7b2b39-3ce8-453a-ba82-049ed826903f", "value": "12288:FFLFQMPPqPTqo0/iR6Jxfwmrh7e4qFaquWXr/+L1iTx390L4ta7+WSrO3z2D4MKU:fP71yaUFc5LrqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773861229, "uuid": "33fb00b9-acd0-4a12-9fcb-569cd784f0c6", "value": 1824372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773861229, "uuid": "0f3e6b52-82ea-46bb-accf-ac5926d68fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861229, "uuid": "69dcca06-3d69-4971-a8f7-81cf8ef8a1d2", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f09bbc-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827587, "uuid": "b289e393-f77e-44e6-bbb3-5568b9b68096", "comment": "Malware payload", "value": "dd813adb1a8fb5aa7fde03e09d219c4a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827587, "uuid": "10c9764e-c326-4e81-a4c8-053a074bd3cd", "comment": "Malware payload", "value": "54a1621b8eb258709362464034ce9c3461b49199069e94c08e8ee47bbb4328ff", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827587, "uuid": "26031617-6168-4f4f-a3b6-5d82a7177479", "comment": "Malware payload", "value": "5bb64d1865f3ca1e5b091649a80b36bfb84cf750", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827587, "uuid": "47008297-55bb-439c-8d7c-38d08103bf87", "comment": "Malware payload", "value": "1e15a70f0940bacb099ea5bc140e78b066c9837cb4a6af8aa77620195059206ddf1557262c0011891d784d9789b68ce5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827587, "uuid": "bebaf9b6-0a69-4efe-b8b6-3bce47005463", "value": "T136E1994B651523F8C20741FA61761A0E7865111B6A441434F7EE8BA0EF4CB39F3F65FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827587, "uuid": "4d31672b-0ec4-4a23-b5dc-497957e5b8a8", "value": "96:BVhhPuasagl8bANxVL7RH+UvskbzwDfX7sDzP71Q1cZNGM0YbQ1Ks/X/ml:zhNIrxVL5zwDv7sDzP5DZNGM0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827587, "uuid": "97b6e880-73fd-458b-8d07-2506e6f67e74", "value": 7193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827587, "uuid": "00eddfa8-a058-4dc0-b9e2-3f1529c19bf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827587, "uuid": "d716d9c0-dd92-4254-9b7d-2a4a62f00181", "value": "RSVP-Invite-DigitalSecurityKey_SA3_CURL_FIXED.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950228ab-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827293, "uuid": "c3437dbd-2aa9-482f-846e-a09d388ee8a4", "comment": "Malware payload", "value": "f309bcbbb6776e64393d048a911a51e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827293, "uuid": "7394373d-80c2-4a8f-82b5-ab36cfc0dc76", "comment": "Malware payload", "value": "54dc24eceeaa72a42017099e31b4a9f2c02af799c3354b94d1df2f6a410abce1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827293, "uuid": "85b5b690-6f4b-4000-8195-635673626407", "comment": "Malware payload", "value": "18b83afb422a97233dbb83025eb59c8ad6a02a62", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827293, "uuid": "7aecc13e-6e21-4ac0-a6f2-ca673844d7dc", "comment": "Malware payload", "value": "1a5bab21ece70659ccb981a068e5c091747a8ea4c9b8dc12de9697c9249af9ec8a31e55c828d573b86a0d3b82a964c69", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827293, "uuid": "55671bfd-78d7-4c8f-a974-cca29e997259", "value": "T1C0F302F8C269A7BCC87AFE21F6D35E4913B41B2198544584B3F800DF27AB785219B0A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827293, "uuid": "1722303f-a389-4a7d-bd76-96dcf131a738", "value": "3072:1Fnsl7n4yTzA3vQZb9se8PlXJgeQRsnphr8VxcuJHjkHZYdXZ:+74yT0e8N5tQIhr81JDk5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827293, "uuid": "02fffccc-5e67-41bb-807b-3740d285242a", "value": 159385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827293, "uuid": "2ff359b2-3e95-4345-93da-2cd90bb439ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827293, "uuid": "126bc0bd-2589-4160-9caa-edf0a2e32cf8", "value": "f309bcbbb6776e64393d048a911a51e1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8feba6a-2314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773870733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870733, "uuid": "c3497cb5-37b8-4237-9b02-e269c41df083", "comment": "Malware payload", "value": "ede0b398fd0a2da4acc4bb3d2ea9fb18", "object_relation": "md5", "Tag": [ { "name": "185-241-208-147", "colour": "#FE6158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870733, "uuid": "2c18e69b-06d2-407b-bcb8-e9b72634c5c0", "comment": "Malware payload", "value": "55d124d2f7f806e16e1f2a4363b6ced4eaa16f93ea37823903666fb3682c5c08", "object_relation": "sha256", "Tag": [ { "name": "185-241-208-147", "colour": "#FE6158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870733, "uuid": "c960457a-21fb-4cc5-b4d3-32440d48e14c", "comment": "Malware payload", "value": "bed20fd8bd7e4e172978e9d1b5c17d6970b94fc1", "object_relation": "sha1", "Tag": [ { "name": "185-241-208-147", "colour": "#FE6158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870733, "uuid": "98a6c0e2-e311-400c-bcd1-348c46a0bbc3", "comment": "Malware payload", "value": "e2b4ff25708fe07fb661ea6c8f7947d822d72ae2daf56dfc9667c27a91ba2e9114ae35bdc96760c1076a2be3060283ed", "object_relation": "sha3-384", "Tag": [ { "name": "185-241-208-147", "colour": "#FE6158", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870733, "uuid": "98acb047-d6b4-422e-8893-8c2a6553b902", "value": "T1AC1833C41FC81047C6AA8F7F9D92BCAD4AE851EC6D4D7EF416BA1394B436F4F0A62124", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870733, "uuid": "a2f0b208-2ed4-43b2-b2bb-657fcefe1924", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870733, "uuid": "66008d3b-6ad8-4fe6-a243-5fd8e9067eae", "value": "1572864:CJYqPsDQQ91cjlC31TM+YOz2wR90wlHDIJF8+/qpatCj9RwSMlL7LLiVjNpQTKiS:CNPsDQIAlqhouxR9PljIJy+Aawj6v+j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870733, "uuid": "3d40bc9b-199d-489b-9eb1-ce7890e42148", "value": 87519563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870733, "uuid": "fc64bca3-3b4c-4866-a98d-926a79337176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870733, "uuid": "d170fca8-5a8f-4ea2-aa42-6c0e76e1695f", "value": "f008b890766eb344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd79979-22e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773849055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849055, "uuid": "65ca069a-df74-4e7c-94aa-ade2ca78d10b", "comment": "Malware payload", "value": "7189e99f650365a0a3ce58db6c63033c", "object_relation": "md5", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849055, "uuid": "db393828-87a3-4634-8723-f03318c09d29", "comment": "Malware payload", "value": "5620216dc128a3d9292defee29b7f295c33eda97e5be9a0eede777d9d70efae5", "object_relation": "sha256", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849055, "uuid": "e1a5fb9d-d19c-4033-b333-8a12e6aa22e6", "comment": "Malware payload", "value": "a30865c03a17eb24407aa1e56216c6c7d745e2f9", "object_relation": "sha1", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849055, "uuid": "f67e0820-70dd-423e-a830-dc9bd2d517d9", "comment": "Malware payload", "value": "809ff319788d07302f5fddb7ffb24eb3108c1c57c630801f2bed841fb299b0ca236a64151bcbcf05f771802de0c07917", "object_relation": "sha3-384", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849055, "uuid": "1bebe887-5a89-456a-b6b7-51b26c60d994", "value": "T1CCF73350E5CAD87FE216F535E6BEBF74407E48CBD293751C16ABEF4B6AAA3064804103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849055, "uuid": "e4896a08-717e-431b-819c-bc9f0ee454d9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849055, "uuid": "7f273aa9-4a7c-43b7-a877-dd9789a05168", "value": "1572864:bDe4hdV6xfBHI7M0zLr1X3OznfxySo3RPqSluhmAW9W:bDe4DoxfJI7vl385ySorOWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773849055, "uuid": "7d711e11-e282-4b3c-a04f-e980847ef1e7", "value": 76383009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773849055, "uuid": "b86e5e75-6247-42fc-9c02-e2b00c7f118c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849055, "uuid": "ea19515e-2617-42e5-be9e-4daf913100f8", "value": "5620216dc128a3d9292defee29b7f295c33eda97e5be9a0eede777d9d70efae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01107835-2275-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773802134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802134, "uuid": "caf59b14-13e3-4c5f-8e0a-1873f94c596a", "comment": "Malware payload", "value": "67d58e9b106eabe0ebe84003f62173ea", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802134, "uuid": "8e436396-cc82-43af-bca3-6143e995aee0", "comment": "Malware payload", "value": "577383ef42a6e32ab44828658cbb0589340828cb55cd296cb18adc0d5e90b95d", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802134, "uuid": "b942c8f7-1e75-4c12-84dc-1b0bc6c1fb22", "comment": "Malware payload", "value": "eef5eedc35347e568464c7c6ab6a47a0bad7cadf", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802134, "uuid": "8fafeb37-6342-4ba0-a7b3-21ed56ce0f33", "comment": "Malware payload", "value": "71de8c06a7f5be4628b5ab113021b09da574db8b5a1edcf72cff7c6d7e5274823450f890754bac7f941162bfc75752da", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802134, "uuid": "8fc78012-fde1-43fa-b127-4300fe10db89", "value": "T144F6F14DA71CEC2BDC719035841D663329570D20BA43EBDB6918778D29B7AE48F8D3E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802134, "uuid": "6f183fff-7067-40bd-be0f-8763a7b82997", "value": "393216:KPLgXjxbKX6g0BjNJj63RngBwEYpjPxNQtev:sLgi6ZBz6VgBoprxNQQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773802134, "uuid": "a5e1e9a9-9dd8-4ff9-bcc9-f8b5f444362c", "value": 16785075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773802134, "uuid": "0adf7f6b-fc61-4a01-82d0-ce416077e192", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802134, "uuid": "6ba3b374-d7ad-4bbe-8f80-c749ac7b5635", "value": "com.kma.sms.messages_1.0.4.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc50a0b-22a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773824245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824245, "uuid": "9d1e8e38-8530-46c0-88e7-f6429726e275", "comment": "Malware payload", "value": "526e844335984d64dc6755f605504f02", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824245, "uuid": "82761761-7681-4d04-a73b-2613a8773634", "comment": "Malware payload", "value": "5790c9545a9e42588063c2f309dc710957efdda8ba05858f7b33d23101763ac1", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824245, "uuid": "fdc4013b-0882-4d7d-ac05-22dcf7038594", "comment": "Malware payload", "value": "f4a657f19f3b987114737799ff785688ffc61796", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824245, "uuid": "e663698f-c3ca-40e8-89b4-5627984dcd64", "comment": "Malware payload", "value": "0beccce632f81fca1cc7e9ea93b41541bd961f87e925bfa583cc3919e9d01e11e4bafb1615b1e56874dec78c8f571f80", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824245, "uuid": "1b336139-09b3-40ae-a25c-15dab9e6e4a4", "value": "T10FC3218F89EA84DC4B1FB15A46CE6D4AEE5F4126851EC5803A4DFE083F35DEC72A46C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824245, "uuid": "9163bda0-0b99-4cb0-8cf3-fda12c8301f7", "value": "1536:7sgWyj0BNp0a4WFWoUqX4QwBNNMmwk+Q45xGQpu0PB9fGnsRdbQS+JUfSg:WWoJIQwPymt+Q45tu0/fvRdbQSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824245, "uuid": "80cfde86-d424-47be-936c-65e7770918fd", "value": 119314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824245, "uuid": "c35e9241-7b06-4a80-be0b-309e27bfef2a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824245, "uuid": "b6bb3bc5-b963-49a0-b8f8-703482c3f7d0", "value": "DevOps_Gamma_Report_151.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc99bbd-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806825, "uuid": "21a2b280-6f2a-4e66-a31d-278f68a6a0dc", "comment": "Malware payload (Mirai)", "value": "23d815d05f6901340b4e2ed399dcc65b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806825, "uuid": "65d1550b-c7b2-42f0-bf11-6e97f34fd2cc", "comment": "Malware payload (Mirai)", "value": "582bb1474d2a8e5c451be6ba65a27f4aa9a682029fc06f47687238db32de60c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806825, "uuid": "83acd941-f2e6-40c8-8d43-3daaac1d8eaa", "comment": "Malware payload (Mirai)", "value": "b9afd2c4642226fa354c1e20047aac2fc2e1e891", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806825, "uuid": "d9009af5-0e1c-4773-bf19-ca6635444765", "comment": "Malware payload (Mirai)", "value": "e70084de44246c5b704edfd8e6ba4ca07b239d459656c5d7f4fae8540f5c298b50f09747b6a075748877d33fa6c66c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806825, "uuid": "7893f02d-697a-45e7-bab0-b76aef328fdd", "value": "T1A3145CC7F801DDBDF80AF73A44130915B630B79114924B3373AB79ABAD3B1961963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806825, "uuid": "7082e57b-cf1e-42be-a725-d944879c1162", "value": "3072:F8qSaAevzBo+dmftXnjMz1uC3+u0mVoVK8V5EApyVxjbi9LlNhy8fl0s:BS2BogkqwVmVo08EAp5L5y890s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806825, "uuid": "fb2c3445-6485-4075-9d2d-e5d0b7fb8de7", "value": 201440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806825, "uuid": "f26f6049-34d4-463a-9367-f9246a0c2229", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806825, "uuid": "ccae3ea0-dc38-49f6-9432-d73733e94dd5", "value": "nuclear.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894c8a06-2315-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773871082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871082, "uuid": "954a067c-ecbc-41d2-a060-374cc351bd98", "comment": "Malware payload", "value": "0b060d4c767e4a07fa8f47c5b3f1ead4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871082, "uuid": "fb439cc5-c1e1-40a2-ba2d-44ba2d3fca2e", "comment": "Malware payload", "value": "59e656abcbdbcb18b100f87253ce73c1de008828a959f0c76b2aa8a962b44329", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871082, "uuid": "ab55bffe-2f15-44eb-bbc0-8cb1a52f35ce", "comment": "Malware payload", "value": "ca3449e33a5420003d0c367ecb5f35f41699c2d7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871082, "uuid": "bc3ec39d-ccc5-4ffd-a63d-9944edfd9fbc", "comment": "Malware payload", "value": "24aa78d4a476f74f888d9893d7ac566a880cf966fb18ec03e21c4d3a2464e29471ffa3dc28c0d9505513a239a6abc130", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871082, "uuid": "daf6de2b-5933-41a4-a2d6-0addd8cef68f", "value": "T1D386F76B26A48168C1E9923ED0D28A0197F3F5760737C2EF527133A94E06BD35E3E671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871082, "uuid": "ecf22203-4427-43d6-83c1-730b5eea369d", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871082, "uuid": "a59ca884-24a1-4871-8de9-acf931656b5d", "value": "49152:5ZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+9qr9AIv71DMc:5POkz7M/BhDMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773871082, "uuid": "9b7107d3-5f68-4b33-a205-4c4aeaf67de5", "value": 8474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773871082, "uuid": "02908ac9-ce96-4d1a-8540-145d24607aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871082, "uuid": "e271c2f7-997d-41db-926f-c81ab1dc0d9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4d6966-2319-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773872727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872727, "uuid": "9bc914e0-55b3-4941-a26d-4c6e1b606e56", "comment": "Malware payload (Gh0stRAT)", "value": "ad3098132cccf9e450d988037cbf1010", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872727, "uuid": "e7259920-0fb2-46a1-9395-a7093f7cb8f3", "comment": "Malware payload (Gh0stRAT)", "value": "5a37834a9bee62cc7cd4f203343bcc6d6bb986ecf15a00f1b3ac2bea5ff2bff5", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872727, "uuid": "0b41e2f8-c581-4bed-94bf-833744792bbd", "comment": "Malware payload (Gh0stRAT)", "value": "c3d51630538ffb8eeb67e33edf97570c197a5c66", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872727, "uuid": "3138b797-d103-4156-bc1f-c2aeaa0f3448", "comment": "Malware payload (Gh0stRAT)", "value": "91ee9e4a5268010b9ba876e6cbcf06a740a7d9aba2df2392678cdfe6378f5231c77593a1477e672a97b673b13b377233", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872727, "uuid": "08734cd6-5b69-468c-9c82-99a21dc0714d", "value": "T19AC73321759EC232F66F05B19A29DA2EE13C7CE2077044EB93E4F95A6A314C25335F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872727, "uuid": "d3f3c421-3fee-4c0d-9ba6-8e878542644f", "value": "1572864:QxssCWZ+gIlkc4qfqRNQTFtyFYx/TcDrpds:QqO+gIlE4qRNQ5tyFK0pds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773872727, "uuid": "e4c1453c-e447-42cf-b841-d863fbaead92", "value": 55117824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773872727, "uuid": "16b0d9ec-ff31-4134-8781-e3355c3baa27", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872727, "uuid": "2b61bf0e-3ae0-4cfe-b090-f7bae616775c", "value": "MSTseg-Teuener-x6.4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753458ab-2266-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773795887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773795887, "uuid": "9a5fc32b-2d1e-4ac3-9755-09adb05d2ff0", "comment": "Malware payload (ValleyRAT)", "value": "7115f4aa3cca28ad8b2bb1a011ba7c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ValleyRAT!MSR", "colour": "#00C9ED", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773795887, "uuid": "8b9d1bd7-be27-44ad-97ae-1162c3f862c7", "comment": "Malware payload (ValleyRAT)", "value": "5c1831e49e730910ca24bf165631cba2eb55c4764f6e6737e1e169ef710c533d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ValleyRAT!MSR", "colour": "#00C9ED", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773795887, "uuid": "bcc9d8c5-0c0b-4b9a-a0f6-8235e7f7646b", "comment": "Malware payload (ValleyRAT)", "value": "c65c434ef56f9c482c549ec3551a05af89cc9a93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ValleyRAT!MSR", "colour": "#00C9ED", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773795887, "uuid": "f72c5ca4-581a-46c2-86a3-507a13ebe540", "comment": "Malware payload (ValleyRAT)", "value": "0a96548ef843d25ab42f285ecb2ffb8eff5fafd97d0d2ab30632cdb646e6846fb326a6ef5c7f3bbce30dcb96dbdd0476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ValleyRAT!MSR", "colour": "#00C9ED", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773795887, "uuid": "b6ed998b-526a-4889-817c-291edaf425cb", "value": "T1014423E4D3F07F15DDC9CEB8DD9CDE289D04CCA3456F0267AAA422D96B91209234BCE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773795887, "uuid": "90734e85-1212-4338-a360-63c324d19899", "value": "770703a8cc0894766c88efd6a1de2754", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773795887, "uuid": "6ee8367e-a7f1-4306-87d1-6f88f6d024a3", "value": "6144:HlOLCVtn7M2XXSecL5PkI6M8cLW6O6IGNisgBMh7oJbZMUeWHU:gG7jXg58UPxis2M+J9uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773795887, "uuid": "f7f8d590-571e-4f0e-bf40-981434dc6a2b", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773795887, "uuid": "b195bd81-4531-4ede-bca9-b90a45665fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773795887, "uuid": "fdc1ca06-dd27-4474-af88-9ed0cd6217f2", "value": "127.0.0.1_\u538b\u7f29_143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49252ae7-22a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773824589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824589, "uuid": "ebcf7261-f679-4761-b5d4-81659e36c8ab", "comment": "Malware payload (Vidar)", "value": "93161aa146583dffe34dde804decfdb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824589, "uuid": "711828f0-29c7-487a-861a-8aec0ec50574", "comment": "Malware payload (Vidar)", "value": "5c3b8289aae8beeda82671ef5e1259debbd0aa5dcf2010fba8f5bbe4a5e32d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824589, "uuid": "6981a073-cb14-4320-8e84-a4cda65bfe77", "comment": "Malware payload (Vidar)", "value": "e87c2cbfdb32bb53f26c2dc807c0ee947f3776f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824589, "uuid": "91202018-3e2e-448c-bce7-ab44e6dc2315", "comment": "Malware payload (Vidar)", "value": "d07503c782b5146c74bafe277a31714db869f44860742647a292eacf5c365597da433bba198ac78666d721e25a90d16d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824589, "uuid": "90b1ee91-f52a-47a8-851b-7ed453aefc52", "value": "T153A57C0A7CD144BBD46AA33289B352A2BB35F8090B3223D32F51AB782F767D05E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824589, "uuid": "62797355-da05-42ea-8b7c-06d38a30bcbb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824589, "uuid": "2e899ca2-8e40-46d7-9d13-8779b6787a6b", "value": "24576:RXTeXeRSX4JH0s4HI/8McVrSMHBZqA7bvvU5yyqNRO3GiWCGMleR5i:RXCXeYlDhrLiqNRO7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824589, "uuid": "c8cb4e06-eb37-4a48-99a8-89cca231cf9a", "value": 2147328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824589, "uuid": "25b7496e-eba8-4b7e-8cc4-5bf04ca0187b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824589, "uuid": "6f9528ea-4fe6-47af-9c9a-5f7b92ad8b3e", "value": "0yube3oe.gc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fb4e05-2324-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773877392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773877392, "uuid": "e991e3a9-160d-4b8a-a1c9-7257bb7765e9", "comment": "Malware payload (Mirai)", "value": "544ef4279e7118bce0903d2263a7cfbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773877392, "uuid": "4dcd110e-f87c-41cb-9750-afd39ee46da9", "comment": "Malware payload (Mirai)", "value": "5da5efe3cdae7318457a45b7cbb6fc426f7099fc196012da6eb6446959080947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773877392, "uuid": "987fb6bb-f474-4b75-9657-255137c96a0b", "comment": "Malware payload (Mirai)", "value": "9c9c3d8661c613b9735dbca1b23831d345a74dca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773877392, "uuid": "07d12b96-d40b-4d2e-91a2-c115372bf269", "comment": "Malware payload (Mirai)", "value": "8c4d6b96390d90db2889d3c2bf46746954b27c79a86e677e12793b43b74ad2960ccf00c7472d9801c7886b66bc68575d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773877392, "uuid": "658abaff-c373-4302-affa-5313fe971dc6", "value": "T1A0D3E70ABB510FF7E86FDD3746ED1705298C591A22A83B397A34D828B64B64F05E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773877392, "uuid": "581d971e-9e57-463b-ac77-ccb6088bea75", "value": "1536:OXuiWsqNzORgyEiGEj8TRfcN7Q/G15CAKQP8JdnVvej6wNfwRw3Y1ZdGsQHVdzT:oWsqNz/VfOUdlejDwR9J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773877392, "uuid": "485edddf-cb3c-478d-a900-9aa4468ca84c", "value": 134020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773877392, "uuid": "3b95e53b-746c-491b-b8bd-f646582b0ef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773877392, "uuid": "afca0804-ca2b-4f0e-87d3-0dd81286aca1", "value": "tux.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b38116-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851660, "uuid": "573a047d-1ecf-4f96-9bb8-d40767b6a2ac", "comment": "Malware payload", "value": "3a33fc61a7c5b56a38382af2933b749c", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851660, "uuid": "effc9299-ea86-4105-8bff-4de7e84d374d", "comment": "Malware payload", "value": "5deb073ff00c4eabe6441877bf8679ebc7bb05e226ab37309fe9e94b30ac84d8", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851660, "uuid": "1332c5df-12d8-4910-becc-98334555412e", "comment": "Malware payload", "value": "62fafd4c7e62b7b4d4a9f65f5e6f8a86c4a00e2f", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851660, "uuid": "e1103ddf-d470-47e3-a67a-927b55baaf41", "comment": "Malware payload", "value": "ec37bcdaaa52cc45395d1aedf5b1db5eddb7ae6ce0bfa4033f4cc1713dfbc1a09c378e4237aeb11dacb731e2eb46fbf5", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851660, "uuid": "e97c6a8c-4dbd-4ad9-966d-8e1ccb8eb837", "value": "T1D5C30247CC0CB28CA7B97808A96B51A0DADF150705B54FF17ABCB6BD1F7A3692009CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851660, "uuid": "57f178c4-fa33-41d8-8c01-ee8894e1fcec", "value": "3072:nHp1zApgFCI2OqvP/O/pui7qT9ayfbRPdcEzA/tMT0jVFK:JSGCI2OanSpucmR1v8FMT0jVFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851660, "uuid": "860c590a-1675-49f0-b03c-383020e7042a", "value": 118304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851660, "uuid": "4098b55b-b724-4314-8bb1-4a8695d7e5a3", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851660, "uuid": "fa0ae31d-24d9-4b7c-a818-4eafb86ae758", "value": "1SPhMAR17_Asssss.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4231805a-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800955, "uuid": "64122dd2-9114-489d-be93-61d9f8b622c9", "comment": "Malware payload (Mirai)", "value": "1f1aeaa9190a413aa6f186bfe94380db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800955, "uuid": "b9090a1d-f790-46d4-b5e0-371149bccf0b", "comment": "Malware payload (Mirai)", "value": "5ef3c087cd5d02544be1c631c61b18a1bb4efd32b106023fb0dda00668b91424", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800955, "uuid": "b239e2bf-54e6-441f-a7f4-dd22b18d5527", "comment": "Malware payload (Mirai)", "value": "1e036e74520061d07e8f32d67592f7f8ab177d47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800955, "uuid": "54f488ed-49db-439b-bc15-993c30b1a565", "comment": "Malware payload (Mirai)", "value": "34bd3572980d28b224816f8dc5f628a8a7c85846588b6c137426f1e6b336f5e2b31e5103de7fce99a82ac7eb8b42a66f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800955, "uuid": "68a43476-e060-4f7d-b9a3-5869064a1560", "value": "T136D2D07EE675E8D0CDBC6D76A4DC0BA68E40B1D1334E9FE98324CC44EE4BA89344E064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800955, "uuid": "00b0d481-a510-4121-b100-ff2568afcbaa", "value": "768:XUX5F0jxt87RyJtwHlTxuldWBKI6tkZWZJ:XCF0jk7RUQxIdWB16mKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800955, "uuid": "7a7f4529-36ee-4318-a795-f052620d4cd8", "value": 28916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800955, "uuid": "cdbadf38-edc2-4948-a996-9f4326169a34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800955, "uuid": "356ed3c4-89d3-49ae-bc8c-de9e9ba3427c", "value": "dontcrynow.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338d352c-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827130, "uuid": "aba552b3-a18b-459d-90fc-1083c7dc4ea9", "comment": "Malware payload", "value": "e2e3d80fa3495697b1fde23c2823e7d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827130, "uuid": "11652a25-bb86-49af-8ff0-e780785a02cc", "comment": "Malware payload", "value": "60376f1dd1dd0367b940ccb83e4d7b9257dbb443486d33617fc7c1b096e470cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827130, "uuid": "9079bb81-64c7-4aa2-beb6-f69d2f6468d8", "comment": "Malware payload", "value": "c58ce0e3a8eb4decdfc95232ca929d5453250d7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827130, "uuid": "1c72984b-b9dd-4a64-8a90-5e00fc767eda", "comment": "Malware payload", "value": "6b8fafa394de1eddd99f27fba8afa9f47c7b3925861cca89b3eda2b4ec3b8a6997b6d33f9848711426342366024f2867", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827130, "uuid": "6e574435-aa13-4fce-8126-96845b59cef0", "value": "T1605357D9130E580D0D077EF8771B889BA238FA6D7418EAFA555068EED0A7E31F348C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827130, "uuid": "eb974d4c-24a0-4db5-b27c-2be37a824cb3", "value": "384:f8EhGLyQZ8H+JnAs3QA5DkdjWaY/TL+FOQtRPjuNmB8D28lslR3Wi0sh5r56VGR1:JHh7aa1d1DwLobtzg7asgQW41M44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827130, "uuid": "68116bcd-fa1c-4f6d-8b0d-9f6b951706d9", "value": 61940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827130, "uuid": "32a8a6ff-2e7b-420b-88eb-ce68ab627c94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827130, "uuid": "164cb442-0ded-4095-9dff-b4dae77ecb37", "value": "e2e3d80fa3495697b1fde23c2823e7d7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9082c78-2303-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773863405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863405, "uuid": "888141be-5e8b-4ece-8d37-4081b0f7ce2d", "comment": "Malware payload", "value": "a052626880f690c907ddc61885b89418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863405, "uuid": "744b5ce6-a495-4920-b2af-a43b33647371", "comment": "Malware payload", "value": "6062f35b1f11cbf6263d342cfe55ddfaa91a5edc68f0d8ffefc1c63dd9d14449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863405, "uuid": "0afc3b4a-16a3-4678-82e6-95cb97aae0aa", "comment": "Malware payload", "value": "ac5251f62f1fe507dc77e33dd1a61b1f99b90764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863405, "uuid": "35173a56-2835-49b6-b2a7-74dc6d22364c", "comment": "Malware payload", "value": "5eb1b9ddb75817d7d381fc023f7b7f810ae22f151deb491ea8e98490bc18a32a38f1707f8f31cab44eca2d8a5a7dea8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863405, "uuid": "d0cddce5-ddc8-4f24-a04b-f940f1d0df69", "value": "T13A579D15A3B814A9D426FAF4C64593F2CDB17C62473E914B0E9AD3061F779A2BB3F600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863405, "uuid": "b84ea90e-a3ff-490d-8c5f-052144762595", "value": "2ecf0f36b78ff6ae7f4aa3f199a901cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863405, "uuid": "c2981b2c-2388-40d4-9413-4624e1f5d9d9", "value": "98304:puUH1NnrIRubPm3Y+xeeeeeeeOwOmLAcSEEPHwqOFn+3FRKe:pf1NnIuAJEccSrPQdF+VRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773863405, "uuid": "75323870-6f85-41d4-931b-d4737ec364b4", "value": 29539328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773863405, "uuid": "32c73455-c868-497d-a961-d5d6e7756ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863405, "uuid": "4186218f-4ffd-48f6-83ca-d94adfc4d619", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832856b3-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801494, "uuid": "66aa7726-f047-4897-a661-c3efc48842a6", "comment": "Malware payload (Mirai)", "value": "d0882ccf96c07be16f2adfd78fffad28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801494, "uuid": "e07023c8-7196-4878-bb9d-cd4ebead270b", "comment": "Malware payload (Mirai)", "value": "614190f7cf40d79b6779db4f7a545223c025afafd5ba2e1967d9bb09888af0d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801494, "uuid": "c227d96d-fd33-4750-8459-a4368b932e1f", "comment": "Malware payload (Mirai)", "value": "fd5f241f521455c01868ef863ea0a41f65b2920c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801494, "uuid": "c151c17a-89c9-483d-a0e3-9220866b9380", "comment": "Malware payload (Mirai)", "value": "289b3c89f919d02a8a34cd697139fba461e277688be43aacc580c3338258b708bf2f9904cd5c555b31b5154feecd2471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801494, "uuid": "f207ecc0-3879-44f1-8cf0-2d86096df67b", "value": "T1A4F2F2ABC5C97416CFF1887703476A91B66539600FAF7E922DE8B1CB3CE524642B1272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801494, "uuid": "64331654-dea9-4232-9c33-091ca78df428", "value": "768:AKdDrsbbwOV151BP46Lp+l3QdV6cg6ydgQbakoOTeVp8:VdqA6UgdV6cnydgMnSf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801494, "uuid": "8268d80b-c137-45e4-b785-a2082a1b7869", "value": 34400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801494, "uuid": "46f4ce6c-6c97-43df-9459-0adaaaa50313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801494, "uuid": "80c4dda1-0c16-4ca7-b227-58763de5b21c", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b89bb1-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827316, "uuid": "5a4432c0-a516-4091-a4dc-cdfe19ffa57d", "comment": "Malware payload (Formbook)", "value": "ea51dc6e6bc623d025122a3c320c524a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827316, "uuid": "f561feac-25b3-44a7-bc61-a478e99be103", "comment": "Malware payload (Formbook)", "value": "656194f219e95274e2a052d069b9f3863d1523ddc2ebe23c54df6a5de8149ba4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827316, "uuid": "c968f546-6eab-4354-b724-bba3c2b31fc1", "comment": "Malware payload (Formbook)", "value": "393e0a1fef5861c787d175cf80aa999caab8827f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827316, "uuid": "a7277bf1-ff67-466d-a089-d76eedc5bc1f", "comment": "Malware payload (Formbook)", "value": "44f02f4f85c44f45e10041cbbdc49e46d9cf01ec6d1f99af26676533e1402573d9ddd90c6ba46f6a61a288606919906d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827316, "uuid": "9b1435ad-930d-4e8f-899a-821d4a4737b8", "value": "T1F8532ED7CA0588BBF5AA3F6CAC147BB63BC94C4545BC895995873C9F9EF86392324C00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827316, "uuid": "4732c1f5-2b0b-4843-b2a3-7dfbb8fc4f8d", "value": "384:TQl7iG+RFZP7wB6DMTcfoCTDV6Qxve+q0ilL9iONpCLKO:TQl7iG+RXTwB6DMYfbTDV6Gvej5Y4pCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827316, "uuid": "0b510066-2f12-496f-b557-c0f98b9667a6", "value": 61462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827316, "uuid": "18109131-f3b4-4873-8b2b-bb077c8ec0e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827316, "uuid": "71ddf226-fd40-43c5-bf94-1f757761524f", "value": "ea51dc6e6bc623d025122a3c320c524a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92219aa8-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801519, "uuid": "bbf98612-7930-4bc6-8d4e-bd88a48c303e", "comment": "Malware payload (Mirai)", "value": "f9c22382d56d6daba4eb18b2f13ae4b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801519, "uuid": "3b069218-f1ff-4f37-8de5-a8712e3e2ac6", "comment": "Malware payload (Mirai)", "value": "663b943fa8ca6f4d2b171c90fabe19f4f44fab378af013a10feaaaf244cd283f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801519, "uuid": "6f196231-104e-4631-980d-7cac8b2ffdad", "comment": "Malware payload (Mirai)", "value": "3b076434877f36ff12c99cc50b87d2e9b6a6cda6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801519, "uuid": "b11d16fb-7a31-45cd-b923-5694e518bcaa", "comment": "Malware payload (Mirai)", "value": "157d336904787d1252c1be0f9356eb0a767c99cdaea37af0d48299af92d4abb7f53b63845d3522dc98f8d42f5ee7a151", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801519, "uuid": "102ca1ac-732e-477f-8c92-c71e89e1c257", "value": "T11793F706BB550FFBDC6FCD3706EA070125CCA51622B97B7A3634C928B54B25B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801519, "uuid": "2e24fe6a-d394-4527-b843-35f82d22bcf8", "value": "1536:0o61SYoAIl1sXQgj6M1NwICrfMz3trDZ4lk9BxRIzCm7JFs/O4:0D1SYoAOjrf4tD9Y/Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801519, "uuid": "f6840b52-dba6-4201-95ff-8cd7075b3457", "value": 97596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801519, "uuid": "e342a392-9f5e-4872-a486-0175b00c6c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801519, "uuid": "2494c8bc-aa31-4711-9e03-50ee31fb233d", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa40317e-22ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773853528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853528, "uuid": "bc638398-2de8-4a27-bfdb-0ad197a30d52", "comment": "Malware payload", "value": "2dcebe31ff60be3a1edcdc37558e75f2", "object_relation": "md5", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853528, "uuid": "5169e6df-36bf-4499-9b3a-ab8396481c6c", "comment": "Malware payload", "value": "6740023be829f84fa543ebfb2f745e33cba576ed8f51d4fdb4331dc36c16a3b7", "object_relation": "sha256", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853528, "uuid": "aea2af6c-057b-40c7-a1fc-30f0fcaea760", "comment": "Malware payload", "value": "94c080655148d278c7998a7e43f0da08753166bb", "object_relation": "sha1", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773853528, "uuid": "22cb261d-b28a-4676-989a-7f2517e2a15d", "comment": "Malware payload", "value": "e4e460ff4bcae7ad54cb919275a096b913b757eaeea6cd46e62d17f5f73b92c33023c225e07cc73360e0e47954e2958b", "object_relation": "sha3-384", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853528, "uuid": "32c11207-1362-4b12-8d60-8cd1e11634ac", "value": "T187432906A1A531BCC05E803046574F23A5BA7C0855736CF70BA1FE793FF5528A27AB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853528, "uuid": "576dc31e-c2f6-4e83-9c63-df30bd004980", "value": "20950c93f21e57e75716f301cc245775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853528, "uuid": "a7329f63-dc46-42fd-8829-ba85652f09f2", "value": "1536:8gs5VW8P5SzyRUjD61egrg1QGUvwvCCw+0XPH6UISDQJ:8gY7P5S2PXPH6U0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773853528, "uuid": "656666f5-b4f9-4250-840c-6b8eb8c517ce", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773853528, "uuid": "929d895f-e20c-441f-b1a8-fd6a3d2f340a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773853528, "uuid": "b58446f8-e57b-43ef-93c9-f354d9b04890", "value": "6740023be829f84fa543ebfb2f745e33cba576ed8f51d4fdb4331dc36c16a3b7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351aab1d-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773827133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827133, "uuid": "ce605243-550a-475d-8f07-dfddb7a94066", "comment": "Malware payload (AgentTesla)", "value": "3ff86d799016bbdcd15342629d01bc0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827133, "uuid": "ed52fb3c-589f-4edb-a3c9-94ab1030d982", "comment": "Malware payload (AgentTesla)", "value": "67c3ba33a3812084aa6b601b1cc1c51ebd2bd2141d6afddf92293a50298f3ae6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827133, "uuid": "a4765e2e-07fd-4c41-bccd-2ae1c234db9d", "comment": "Malware payload (AgentTesla)", "value": "b179a04616238c97b82abb2a1eb69799ae5aa29b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827133, "uuid": "f4bfed6a-7408-49dd-8032-7540c44378c9", "comment": "Malware payload (AgentTesla)", "value": "3119de8b4b347b62abe90f0aee693e13e29089f7f7fcb4d046af68e5682fc2e5cdfcbe3546e005149246b06096b80410", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827133, "uuid": "a71c9b3a-bb7f-4e45-93c4-5192067bfa4d", "value": "T1D33595D0AF85B6A7013FC20C1BEB597AE94805559462C22C6C9FC5DEC2B094EACF4E77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827133, "uuid": "2df65888-8d6b-4ced-b4c9-c17d4f9b0bc5", "value": "96:f77777777777777777777777777777777777777777777777777777777777777w:nEprr1/ZkESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827133, "uuid": "f989ed30-69ef-4ae6-bb61-255e8bd43d38", "value": 1146384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827133, "uuid": "1ea9bc0f-389a-45a6-bba3-baac019bbbd2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827133, "uuid": "8aa5f2ae-c984-48b5-8bb1-d2cf39589a8e", "value": "3ff86d799016bbdcd15342629d01bc0e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa89f52-2312-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773869769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869769, "uuid": "70155a3f-4a98-4411-ad9a-d68fd0c003cf", "comment": "Malware payload (Mirai)", "value": "095e96425e3d5b5ecccebb9ff532514a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869769, "uuid": "e86a4fd3-357e-4c2d-8caf-21c32e4fdd50", "comment": "Malware payload (Mirai)", "value": "67c42ffcf3e88836548023d69bde0e8d86596ede84a2b2799b6d9dc2d3af65a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869769, "uuid": "23ba5406-a56c-4737-b0dc-0500edb0366c", "comment": "Malware payload (Mirai)", "value": "71288d5822909421ef66b7b38ce77f063a6074b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869769, "uuid": "45bfed86-9272-4ea8-9b68-a8abdcbbe94e", "comment": "Malware payload (Mirai)", "value": "ebcf3ff8b3836f051744bf0bf8ab1667390b6c1ff2b35cb721959ead510ea20279e2e04f4100243d83079247fbf70a8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869769, "uuid": "78c01d04-da4e-4b2c-9900-c3563c4ca064", "value": "T1F0042B46AA418B13C0C62776FA9F42493333AB64D3D773069918AFF43F86B5E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869769, "uuid": "36de9b24-e518-4f92-8dba-743fec472b47", "value": "3072:8mfWXi5vrH/pfrs4CadxM0j95GxS8Jc9eauTYxZETR1hM/9n4rWI:XSU1rXCadxM0j95yS8W4a+Y/ETR/M/9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773869769, "uuid": "a8d22fd7-2b88-49f5-970e-f04616030d5b", "value": 182595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773869769, "uuid": "f030d694-6637-41d4-8f7f-c7b0f61a90ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869769, "uuid": "7e5b64d6-1f76-44c0-a58a-4708d15f882d", "value": "tuxnokill.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad41b89f-22dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773846662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846662, "uuid": "92343b64-77b9-4098-ace0-72a86307dd1b", "comment": "Malware payload", "value": "73c82fb44e798ab31e7ec9e32be4f254", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846662, "uuid": "89cab87a-893f-4a87-8737-f7f63483c72d", "comment": "Malware payload", "value": "687f4a4b6119e88abcd7aea1223287e0cebe5f7a424371676ab7e11bc3fec2ab", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846662, "uuid": "3528ca0f-f29d-4b18-a95b-136a3a39db3f", "comment": "Malware payload", "value": "7a6e167168fc750921f3ae80e8a87e20c69c9743", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846662, "uuid": "82c516a3-6170-4d37-bcd6-ff4f992ac11d", "comment": "Malware payload", "value": "46293345bc76a70f147f68017a546b5a11d010bcb55c7c2416a4b867efab22ac67781316a14b5716af1dc83bdfbd16b2", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846662, "uuid": "9389c17c-8040-41c2-871b-128ada46a1bf", "value": "T1F60126822D14C6589090B3C3645DC98486B6C11768A0F3F25AC4BFAA55B7B744D6A4BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846662, "uuid": "42226d74-3009-4fb9-9941-27a35d056651", "value": "12:5VWYYrw6KNkIMdO7YvFD2JLGHrCclDHtiTDkxLzHCCclDH8iTzYMeq:CbjGkLO782RGHuclDHtiXwzHVclDH8iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773846662, "uuid": "a79c41bf-a201-42fc-b3fb-ce6c28e925a6", "value": 663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773846662, "uuid": "23b80254-a815-4172-97dc-2bddd77000b0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846662, "uuid": "0de36363-da0d-4937-a901-3a50eea7cc99", "value": "Phmar09.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcf7e30-229d-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773819628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773819628, "uuid": "da29b39f-7076-47ac-8a18-6ece42f8801c", "comment": "Malware payload (ACRStealer)", "value": "14badccf87423ef0ab27d8a47a2f54a4", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773819628, "uuid": "1c6b7a67-bddd-4c0d-80fe-bb2c678ff0a3", "comment": "Malware payload (ACRStealer)", "value": "692e7f97c1cbd663b6435bfab4bda11fe84c4ecb3941cc5748f7ee8ca387fb57", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773819628, "uuid": "20e3c758-ad1f-4813-9eb1-890fed3ff4b0", "comment": "Malware payload (ACRStealer)", "value": "7ca13b78aff9dfb31a40e1773b1dc856d0243b4c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773819628, "uuid": "4f09abf4-7919-4be4-a4e0-9edc4a9734d3", "comment": "Malware payload (ACRStealer)", "value": "136d54a9360603c764f51563c432fc2927ae127b041a7fcbc075a1573d85f727dfe248b2c89a0e9170d87265bdc5f640", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773819628, "uuid": "4c9b0195-5893-4fbd-9380-eadc2e7c397b", "value": "T13C65E845F8C63867C3730173B6138C22FF3949C3616A5D99B0AD32AB6FB75A8536B421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773819628, "uuid": "cf64be2d-ac95-47c9-a7be-4028d69a27b4", "value": "1eb6d0392d31514035d702dc89274abc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773819628, "uuid": "3e3f9686-27f0-4bf5-8d4f-154de2678141", "value": "24576:v2/rG8txZtNiDDDDDaDDDDDaDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDcDDjW:f9+XTrjAq8cZmObTyh1+NqHwEk/YILFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773819628, "uuid": "cb8a2658-2e66-4ab5-b6b3-ffb5ec5ae502", "value": 1508864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773819628, "uuid": "7df86e31-5d11-43fd-97ad-fd7f87bb70ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773819628, "uuid": "807b34d6-a600-4451-b29a-04161390798e", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1c547e-22c8-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1773837883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837883, "uuid": "1a39257d-da63-4033-b884-c4c601305c87", "comment": "Malware payload (DonutLoader)", "value": "80096ba42466ca91e102f1c15d6015be", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837883, "uuid": "2eb90304-8782-4ae0-a54c-8ba58b15f28d", "comment": "Malware payload (DonutLoader)", "value": "69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837883, "uuid": "569ef2da-f083-4c2c-9b1f-3621e1c420b3", "comment": "Malware payload (DonutLoader)", "value": "c471a56195adaba864af4e574fa4c664ef5d26d5", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837883, "uuid": "08db3d6b-6666-4f09-ba76-539929576c7d", "comment": "Malware payload (DonutLoader)", "value": "29021fb5567351293f970097edfa7ab4ebc3ec829ef50fe0c7cfefbf3b848adffaa6e5cc72e97ca12b594851d949e303", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837883, "uuid": "2cb34aea-f694-4f5d-8e02-3fb41103d638", "value": "T13666B604E31C5A70FAAD562CD57E7E60890863476244EF3D36BC471DB3A272B139C9EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837883, "uuid": "2660c1ba-3e40-4975-9171-2e1f3586e647", "value": "98304:al3KA97+dLV27WVdJAmAlTfs9hGX13qqqAjnUMLNCMgeKIQ/GKVBc36GpBslZfft:acA9Klk8dKBlTXzpxB1KIQrVC36JRZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773837883, "uuid": "e8c11037-d3bf-48b2-bbbe-74f8d9264f7a", "value": 6727950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773837883, "uuid": "147d39ad-3316-4d8c-9b29-f863bdea6f39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837883, "uuid": "011d43ab-18e3-4c8b-8a00-5b1fa0746a17", "value": "New order N 2160848.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96a6eb3-2314-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773870787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870787, "uuid": "0c4b693a-3809-49cf-b2ca-396971e35d96", "comment": "Malware payload (Mirai)", "value": "cc55aee0bd72fa97ab6806dd1cd92f9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870787, "uuid": "c3272df9-483c-40b0-aa7b-f3f30ac8a15c", "comment": "Malware payload (Mirai)", "value": "6a6adc9d0b8be0da006c11564827258d086da534da452229865314446f36f563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870787, "uuid": "224d57eb-fe8e-4fa7-b05b-168ec6ada370", "comment": "Malware payload (Mirai)", "value": "a311711b2b24f8a1660054092c319bef84b96cde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870787, "uuid": "87230873-8596-4d46-aca0-2c3a054474df", "comment": "Malware payload (Mirai)", "value": "adf20a372f97df34ab4bac16a35bd430403da9b98b21712ab819bcc53b146dc60f0a24d83cc8f134b9abda7adf69696c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870787, "uuid": "6aa8a5d3-92d3-44a3-8ee5-ce8074854b7a", "value": "T137C3D50ABF511FF7E8AFDD3749E9170528CD560A22A87B397A34D818F64A24F05E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870787, "uuid": "bbb59526-286d-4929-bd5e-2834d601e433", "value": "1536:5BwbnKw7R4sJ7osNXziD1jhuA18NOOaZKu/8Ll9a/fD0lVDmMv+R:QzKw7R59XzWOaiaDMF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870787, "uuid": "1fa469f8-7ed4-4e2c-8251-30f52cd7d4ab", "value": 121416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870787, "uuid": "bd61b2bf-f819-4fe3-bf5d-ee482a76f0dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870787, "uuid": "2d6f06b2-9a15-490d-a6df-0535cb3843d8", "value": "tuxnokill.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76377060-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826812, "uuid": "add3129d-2e2a-4925-81aa-cd39f329af4f", "comment": "Malware payload", "value": "b575d04ad4fc1ef964fe006f00e8d328", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826812, "uuid": "516ba520-bd3f-4415-bf32-4a48168c897e", "comment": "Malware payload", "value": "6a8f7d1edc88b519ff45dc206c1f2e72340b9aaee8c44c064fb3f33849ac7ece", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826812, "uuid": "208ef85d-1c4c-4252-95de-0fe716037474", "comment": "Malware payload", "value": "1d64f7bfea97af5d552c5e97510712796cba770a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826812, "uuid": "3a3dfd40-04aa-477f-b459-c35d1300522a", "comment": "Malware payload", "value": "ebd02d800158082083d0e04e9cd8de16ca6a54ff3c64d8679a5ce059b3b302d1c83390d350c02693eed86676b2f4bf1d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826812, "uuid": "8446c605-ff50-4741-969b-e7b46b7eae2c", "value": "T1CE135CF61113ED9F8B2B0E41F40C1102ECADBC9372D954B8BF45469A4EE952C9EB8D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826812, "uuid": "91ab8bf4-9ee9-49ed-8a6f-2c809074c31d", "value": "768:LP1XDOGXeiiS3cUZvsSE+uRs2jBB33yHE9QQBj81shaG2sUq6SIcH+VD:rxCGXeFSbqCHE9QI81z7rq6SIcH+VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826812, "uuid": "5ac5bb12-f233-4339-add8-15bf5063233f", "value": 44376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826812, "uuid": "492fe1e3-07e4-467c-b0aa-ab0ce7b343d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826812, "uuid": "723093a8-e528-47b6-8c43-09a7ce60f44a", "value": "6a8f7d1edc88b519ff45dc206c1f2e72340b9aaee8c44c064fb3f33849ac7ece.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1214cce7-2291-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773814189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814189, "uuid": "500b17f8-58fd-427e-9cab-ec9b92dccbce", "comment": "Malware payload (Stealc)", "value": "296625fbcb563f60d34c76006982e39d", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814189, "uuid": "ceb8d5ad-38a8-42b1-a8ad-ace6ad259cb1", "comment": "Malware payload (Stealc)", "value": "6ab011bf4159dced5e9972284b65a82b95d772cf095c5c62e55398816cc64d3a", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814189, "uuid": "4ce8576a-760c-42cd-9dab-e8d0168945c1", "comment": "Malware payload (Stealc)", "value": "7184b3526aa591c6099170f4dd59e2cca4404aff", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814189, "uuid": "bf237f8b-b407-44b7-be98-345581b8ca00", "comment": "Malware payload (Stealc)", "value": "5564f17372a9d9ed54558d589f90691bbab52038173e4c8b494520e5abfc975052e94be251aac8ae2b48d5d736b55ab9", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814189, "uuid": "fd10cb2f-0352-469e-a163-4564806e224f", "value": "T1CEA5AF4A7CE004BAD0AAE73689B261957B75FC1D1B3233D32E406A783F797D0A978750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814189, "uuid": "7259b27b-5c4a-4573-b10b-89782de58a7a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814189, "uuid": "d3f5ebc7-41df-4199-8c6e-09b4c34364cc", "value": "49152:eEUzkO4LXkrGH8owBneRJrC4uhBX5VZme2BFMgQUcQVFS:enzocgjc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773814189, "uuid": "719f1425-669f-4257-81a8-fd2267266597", "value": 2201600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773814189, "uuid": "317fd434-146b-46ff-a61f-06b8e181ab8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814189, "uuid": "10d2aa16-aee1-481b-8267-780dd5f81d96", "value": "downloadlink.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44db6041-2311-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773869250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869250, "uuid": "b768c1c4-2723-49e8-8fbe-7a4c7b7c529f", "comment": "Malware payload", "value": "293160ff859b01555f153bd5317eef86", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869250, "uuid": "2c7339c5-a99e-4eeb-9017-12ca1e2a11e6", "comment": "Malware payload", "value": "6b288ceabbc88095af7da24f24f7adc8cc0502a31224b09522ecb851ce594f24", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869250, "uuid": "5097fd0a-bcba-4f87-94fa-2d14cb4c69de", "comment": "Malware payload", "value": "477f344ffdc6fb1aa14e94be6f5e1d69b9a4b667", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869250, "uuid": "aefbe187-0ffb-4a91-91da-9b2b33837a64", "comment": "Malware payload", "value": "4dca9ede90886945bd8ccdd04553da286978268ccce562902d980fd6fdc3b419bcf31f6d18aa3044500896f26d409e3f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869250, "uuid": "66416093-3069-4d2e-bde2-b8b4de3841fa", "value": "T1C196D46B22A58E68C559813FC1D28B0094F3BF790736C2FF425DCF685A415F1AE7AE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869250, "uuid": "a7299f37-b2ec-489d-9c57-5f43a9757001", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869250, "uuid": "ac9f130b-bff6-468f-a277-4abc2f917d03", "value": "49152:TZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+9wr9A7eBl5YEreYXJ:TPOkz7Mlaa0ErZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773869250, "uuid": "34d798c0-b7d7-4c37-b991-66d2021e8921", "value": 8653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773869250, "uuid": "fd639250-4dc8-4b0a-b966-dc50e098da76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869250, "uuid": "c33f8f61-e50a-4e4b-9dbf-f1599636253d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6bacee-2315-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1773870954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870954, "uuid": "8e6c8d3f-520f-4474-9d26-6d0ac0c2a9c6", "comment": "Malware payload (Efimer)", "value": "391f4b6d4f065de123b7a07bc9ca876d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870954, "uuid": "96af7a17-afdc-4445-ab1c-e81343f2fa9e", "comment": "Malware payload (Efimer)", "value": "6b3354b506b7fc50039fe6596d41344d175e9d9337f435bebcd9e5234163ced0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870954, "uuid": "49ca6e3a-49a1-45dd-9cb2-97569b29c3c7", "comment": "Malware payload (Efimer)", "value": "91ea88d459baffb4912fc4114bdddc8ce45eaf2e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870954, "uuid": "061a53c1-2d06-4495-a72c-0f9380c1a63d", "comment": "Malware payload (Efimer)", "value": "be36c2fe4582099708633794ac562fce9a93e779287dc885bc85681fe3c4e4d8fa9d4050e455f7a4b1af732196cd3e2a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870954, "uuid": "74caceca-0a04-4507-a821-934b237b8a52", "value": "T150D6331DADC160EDCBB3D0B47EF22AB5B46178A142B05DBB17A8C3B16C431B85D6C49B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870954, "uuid": "87ce91de-cb7f-42a4-bae0-cdafed54acfa", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870954, "uuid": "d08c139f-3124-478f-ad17-6f5a2466b006", "value": "393216:PsTOEfAbff09WJ9XMCHWUjXccuI3/PGTAI:PIWf04J9XMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870954, "uuid": "da0bd390-e74d-4135-8c48-8e8ed235d5c0", "value": 12623315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870954, "uuid": "b90a98f5-54e8-4fab-a17a-f1673f546e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870954, "uuid": "2b01c3e9-76b7-42a1-85b9-07c4556f7fd5", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad15da43-230d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773867707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867707, "uuid": "0b08caba-b522-4fb7-aeed-c4968221712b", "comment": "Malware payload", "value": "4425b44b1ed34eebae477d39b5bcb0b3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867707, "uuid": "f74ca3c8-7dbf-4889-ac0a-97f09fd2624b", "comment": "Malware payload", "value": "6b3ce22906e5e44d22ffef6b607ca1c65616c01e2c4c04af2d10b842a4d335aa", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867707, "uuid": "f167da24-b9fb-460a-85dc-dc7f55619805", "comment": "Malware payload", "value": "68fcac39280233103f2441f66c60b7a90597f830", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867707, "uuid": "52fa36cf-f832-43fa-890c-33ec4d1fe67e", "comment": "Malware payload", "value": "e33be01739b6576760268ac5a01e3ef537794e965a9bca84e28d715076124691396c71a15b83656552cf5481c6286acb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867707, "uuid": "1e2e9892-c5e4-4cf2-997c-33d8436d7a96", "value": "T185219E902BF54B54E3B28EBD597673628927BD4DDE31D7CD0210914A0970361EC6DF2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867707, "uuid": "0ecf6bc7-e629-418e-aa31-34c76c51fa6d", "value": "24:8n99Ncj9UDj9Lf3j9U3j9ci+j9I2U+/CW0pFjWSr6rxmN4CsFZ:8Vcspf3sGWbpBLr6lmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773867707, "uuid": "06eabbe0-35ff-4635-b982-a916c6bbbfac", "value": 1129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773867707, "uuid": "f11df397-7f6f-4233-ad82-2197bfc7bae4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867707, "uuid": "dbecc35d-cd3d-48f3-9ae0-e06c3ec23299", "value": "AKT_ROZSLIDUVANNIA.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241afc2e-2291-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773814219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814219, "uuid": "73a34211-1693-4797-9598-0c509effff5b", "comment": "Malware payload (Stealc)", "value": "85d685ba889b2ad7cf1e242f760f5e57", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814219, "uuid": "865a2d59-f1fb-468d-be8e-e47d8286f380", "comment": "Malware payload (Stealc)", "value": "6bd5f4c9d14cd1983d4ea7e7dceb5a86941a565f2787e6478684be8c2464f269", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814219, "uuid": "4bc24171-765d-4b94-a8f5-e8f9180a0ae4", "comment": "Malware payload (Stealc)", "value": "7c031e46fc9b5ea2d88bd0e3c7380803b413063a", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814219, "uuid": "438cba0a-f563-4b6b-8dbb-66d6cb7381d7", "comment": "Malware payload (Stealc)", "value": "781f75da06779a325aac8cff2231cf4df8320f54f456088a8b69ace3b698a66cc55d4a1aa0a9b91ee3299131076099a1", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814219, "uuid": "9315c311-ff03-4d87-930e-dd77191d5e9b", "value": "T10DA59F4A7CE104B6D0AAD73689B261957B75FC1D0B3233D32E406A783FBA7D0A978750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814219, "uuid": "1c17cf9a-e031-44ff-882b-9427489e4681", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814219, "uuid": "115fdc99-c4fb-4d77-9c96-7ac824fb16c4", "value": "49152:MEUzkO4LXkrGH8owBneRJrC4uhBX5VZme2BFMgQUcQVFS:Mnzocgjc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773814219, "uuid": "5d549849-dcf7-4d7f-876f-e602830a6c73", "value": 2201600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773814219, "uuid": "16c1b8f7-155f-4012-9dac-e8c33faf4fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814219, "uuid": "f05b7151-e5e1-4287-958c-f043c62761e7", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0aa521-2314-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773870554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870554, "uuid": "dd7d5e48-f9bb-4107-8038-8037f6a9fc1e", "comment": "Malware payload (LummaStealer)", "value": "9e6f7f0e1f0fc37614afeb445f36ef02", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5367", "colour": "#92C15C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870554, "uuid": "7a0d449d-deeb-4024-94f5-5d4422455e12", "comment": "Malware payload (LummaStealer)", "value": "6c56d77d3a3b8c42a14d23bc26b816ce3ccaa4a99cf1fda4d41e759ad164c543", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5367", "colour": "#92C15C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870554, "uuid": "0c7f2913-2d2d-46f7-a6fc-6080d0d2736a", "comment": "Malware payload (LummaStealer)", "value": "3d5e384e3e7cf84b2e8b8d261967bc47461b8c66", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5367", "colour": "#92C15C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870554, "uuid": "e9dfbe06-1b43-4e53-99e5-d5c2e3102a6f", "comment": "Malware payload (LummaStealer)", "value": "da43c132305972afbbeeae7c7904808fa6bc301501d4e32979f6fa017efba32527a3cb332853bc22e1488fd1ec5987f9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-5367", "colour": "#92C15C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870554, "uuid": "170f2a1f-e7db-4108-83c8-e236dfc89ebe", "value": "T1F31633314EED895293BEDED1A5EF6F3CE49A0B6813CA935074F6A1433CB5F821126E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870554, "uuid": "2f4b2d5d-83c4-44ff-bc98-a237e17ecfda", "value": "98304:os5vpiKGTPxp+15NF+njp+ekofBhu9MfqKCx4l5fm8wdxvPcXZ:qDe1x67fSTA5fWPvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870554, "uuid": "771a768f-bd11-4db4-860c-9d4c396b8e72", "value": 4370451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870554, "uuid": "9b981c01-e6a1-4f81-8f95-f7fdc8e5b51e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870554, "uuid": "4b4cdddb-4d7d-4714-a518-69fe83067c0d", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c270e6-22b4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773829360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773829360, "uuid": "388d0010-073c-4214-b005-ed9f529e9b56", "comment": "Malware payload (RemcosRAT)", "value": "18d427f78535ba38a55cc99a5f70554f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773829360, "uuid": "c404cbf3-dbfd-4316-8e67-35b792edbb2a", "comment": "Malware payload (RemcosRAT)", "value": "6ce99f1c6f64c4e7e622285ed1eb35fd8c2dc4615f15a674e829968ac2cdfcc7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773829360, "uuid": "243da1a2-ca9f-428a-b405-b5f34b4ce13a", "comment": "Malware payload (RemcosRAT)", "value": "ae653f829664efac18123939bbbef4444584f59e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773829360, "uuid": "ae1d0974-0acd-48e6-bc0c-fa81fb56ca89", "comment": "Malware payload (RemcosRAT)", "value": "9f21787fd8c82c06ab5595003d03933993a9f3aad4b815741c9faf5b7f052744b62b0858bfa22115dacec178b326f50e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773829360, "uuid": "c575b729-0fd5-4c0f-add8-2ae10db5aeff", "value": "T12623F8155FE008E5ABEB3ED068A0FE51098AE93F02716B7438DD01DD8B417DE2D76721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773829360, "uuid": "dbdd5289-434b-481d-a821-42f4625c4059", "value": "192:L3lZYZFZqCZcJxvoZkZ2vhMYsYVYiYGYp3Y6YtYtvEYjY2KRtOocekmh3:7FiMzaDr237EnGzKdcen3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773829360, "uuid": "9dee71e5-ac8a-40c3-aa5a-a23a5b82e6f8", "value": 49349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773829360, "uuid": "35aaf972-a16d-4cea-a912-b99ecd2da9e2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773829360, "uuid": "f7c51bf8-e8c1-46c7-884e-140a0e89a114", "value": "createdbestthinsgsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a21201-22a7-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1773823833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823833, "uuid": "2164b0d6-94ef-4bac-8c58-babd7470759a", "comment": "Malware payload (WallStealer)", "value": "fd9e38e1799045d32bfba5ea6b6a60b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823833, "uuid": "dba9cbdd-924f-4785-92fc-34be576ea181", "comment": "Malware payload (WallStealer)", "value": "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823833, "uuid": "31b25059-1b79-491c-82be-5972c91c1e4c", "comment": "Malware payload (WallStealer)", "value": "53ec539629f1e112b2e92f139824f0bc1eb2f3be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823833, "uuid": "354825cc-0700-46e5-b569-b4b966da0353", "comment": "Malware payload (WallStealer)", "value": "19d3ebb10dc0df42e84c44ab8c8b59b230923587ca3c5ca01e31c45ae716780ce6b77a135cf8ced59ddac5e63427b4be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823833, "uuid": "13fd8108-6ca7-45b8-9a92-2e0bebb3239c", "value": "T11E96638FB2748613C8E262B5B20635727E2AD435479983B77CEDE435319F0BE4A728D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823833, "uuid": "22916917-4654-4766-bbb7-9dfc7cf1d511", "value": "2c1853915d316a65d08a8dc489aff101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823833, "uuid": "ae591858-8891-4391-adcf-11d08e9d7667", "value": "49152:T9DoEo71k3Q0H9ubngSsLxO9IWV0yJPePn6vE38Xnb/EQlce/gKSFd+RrYP1l8W+:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823833, "uuid": "0e51c37a-efaf-41d4-968d-cfff51454f06", "value": 9436160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823833, "uuid": "0bceaee9-c2c4-4d45-b8cb-e6372d649bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823833, "uuid": "58674389-a884-492b-a4a3-af935b28fd4f", "value": "DAIs3ZV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae9e5bd-2291-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773814257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814257, "uuid": "9ba53270-1030-4a0b-9a78-621945c99dd2", "comment": "Malware payload (Vidar)", "value": "2454c19276475c80f8c6c9531710797b", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814257, "uuid": "6083ef99-eba5-47a5-a470-8cbca91c23ee", "comment": "Malware payload (Vidar)", "value": "6d80cd9e3401b66d8720e8a34124b74bfaf574ae8d95d3d935c53e158395aa49", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814257, "uuid": "0aa6dfd4-09e9-4418-9a07-d57b1b563132", "comment": "Malware payload (Vidar)", "value": "252f27935252cc6217ef796711697f88e212f4a2", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814257, "uuid": "e36707a6-555c-4080-aa1e-fe2ca7a8bbb7", "comment": "Malware payload (Vidar)", "value": "39e041773ce37594e9a45f84f9adb3cb1520d34b61c80707609c31909ab63ebe8d6339c09a9728d54b595423f83d465e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814257, "uuid": "76901249-e570-4423-9e47-1e8b5856cca4", "value": "T138953A0A7CD080BAC069A336C9A652F27A75FC198B3223D72E517BB83F767D05A75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814257, "uuid": "b046da7f-d3bf-4d75-b0fa-811b17989fb0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814257, "uuid": "f0d86b1a-e63e-45f7-9b97-00cb906f0eff", "value": "24576:i+UEUI/hDW/xQD8Fym+VpaHPFoOGiW2bdng:i/7I/uxQ4F5+VEHW8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773814257, "uuid": "97b43cc0-1367-495d-b6da-9a0728ce3acc", "value": 1924608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773814257, "uuid": "b6319a23-6984-4824-9df9-ed4b53caea43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814257, "uuid": "31b20938-d3f3-4055-b74f-3cad10fc690c", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bad1fe7-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800944, "uuid": "d2a1ff57-cb02-47e4-bd00-d0c89307d3a6", "comment": "Malware payload (Mirai)", "value": "aa7a4f90779b05f985f90613b0fb76d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800944, "uuid": "189b5599-a9ab-4c97-b9db-09b37fdd69f6", "comment": "Malware payload (Mirai)", "value": "6d8794dc4b50aba8363b10a7eabb395f101bb3557c333da1fed5fe7838a36bc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800944, "uuid": "b089ad84-cc92-4e0d-9d32-795b94d9fcd1", "comment": "Malware payload (Mirai)", "value": "02d6e52d52261a41b9d390dcd3f2c081681b858f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800944, "uuid": "38257de9-2491-49ee-b134-06b73677ed45", "comment": "Malware payload (Mirai)", "value": "eade99f4d3664c650b34ddf68b82dd046c1496931baa47eb4a4803ec928176ea86f5c62e3c8513fcd6a5f23711884d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800944, "uuid": "86e4293b-3e03-414f-a5c9-e0e790a42cb0", "value": "T1C0E2F151E2021073C5A27CF6B635058A3E37ADACC96970B7337990BA557368E13FA04F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800944, "uuid": "1270de2b-08a5-480d-b694-737816e704d8", "value": "768:/I0LZr2GP0gsMPP+qYLKyMH21G70DL90V+z9q3UELU/:w0LAG3lPvGKD6L9vyLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800944, "uuid": "37a50afc-5699-4490-ae1f-ea64c84495cb", "value": 31780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800944, "uuid": "f0005942-5a60-4de3-b298-856d5f4e0ea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800944, "uuid": "d733d64a-f727-4d72-82ac-1b31040e0d10", "value": "dontcrynow.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f8ff41-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806839, "uuid": "14f283ce-6571-4c69-8e3a-c69792c147fc", "comment": "Malware payload (Mirai)", "value": "0fac505e1c34ad2c2f108c8fa586d8a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806839, "uuid": "64fa60ea-4a8d-4ea8-a3fc-9f04cc0408c2", "comment": "Malware payload (Mirai)", "value": "6daba71be34923681d251392c46817ccb43665818449c68ca99c0f4e58c36e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806839, "uuid": "84bfeb96-6825-43fe-bce2-1fb0fbe47817", "comment": "Malware payload (Mirai)", "value": "ff0b1849f554f3eb7787bd4aee4b780a1ec3cceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806839, "uuid": "435e1f77-1a0d-4276-9062-642e164a5c5e", "comment": "Malware payload (Mirai)", "value": "77e610673dcef81b41c62b91053c1906e3bd35735d0c3b2cf70b1a2780e70a4d3618875a50e8673443e6207a689de469", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806839, "uuid": "3d205eb6-5f75-4bd7-a0e0-2bfa9510c3cd", "value": "T121344B46EA404F13C0D727B5BAFF82453333A7B4D3E7720699246FB4378766A4E26A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806839, "uuid": "a3e77cf7-7cf1-401e-ac68-b806421d2296", "value": "6144:n2Q6YRK8unxh9ua1mHHpUaKVuNw56lxvsIqatkM/R5Stt:n2Q6D9MHpUaKVuNw56oitZ//Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806839, "uuid": "79b86fb0-360c-4ef8-b90a-a493998cebe8", "value": 247991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806839, "uuid": "15bf98eb-e6bc-4bfd-9cb4-6d1e037c610c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806839, "uuid": "20492a3b-6a3b-4a2e-bf64-780da6e39aea", "value": "nuclear.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb8ba41-2317-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773871977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871977, "uuid": "7579825e-19b8-40ba-81d4-624df44fea18", "comment": "Malware payload", "value": "169cdec6a6da4008c6379a0f4aef9373", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871977, "uuid": "5292c5e8-6b7d-4fbd-a05a-0702d4511dc1", "comment": "Malware payload", "value": "6eccf4ea99bd6b2e50593effd3dff0062e0acf9894f701647749b45626da84bb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871977, "uuid": "4828987e-5fa7-4ba4-ba97-ab1f018e84d4", "comment": "Malware payload", "value": "cd7e789ac3ede7b5c6e4586f0552fa3cb8eb8192", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871977, "uuid": "a7774e88-fcef-482b-891d-2d2705a03061", "comment": "Malware payload", "value": "3d7b3fb31d4bae9179b292690e77d083e91811f279e476f293f01ed570a565c519182a32e1f32fbbe5288e5b73a38260", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871977, "uuid": "2ea480fb-dffb-48ea-acb5-1b8745baa26b", "value": "T1C15733EFD4E18B9AE5BF583840B4A59A4573FD259EC3092939187243B4BBFF530B0216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871977, "uuid": "feb1e7a4-8988-4c9e-94b5-6d66a59f62df", "value": "786432:naHLwSHLzdfqN2pW/K4mMVGL+zNrKDUdCk+tqpeeG8TBtD:aHhrzdlpz/MVQ+zNndCk+0pep8TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773871977, "uuid": "d6b6a505-a596-4773-a3e9-9ad697a1e15e", "value": 29696000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773871977, "uuid": "af70e43a-f2e7-48fc-aae3-67c004266c39", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871977, "uuid": "c139fcdb-03dd-4cca-b487-9fc05c30168b", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e808bf95-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806817, "uuid": "f6257da7-4bae-4f35-825a-ca398dd0e488", "comment": "Malware payload (Mirai)", "value": "d245cc9d5a0e1b74fe03d0c579f6eabf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806817, "uuid": "6907fc6e-fe16-4e4a-8dfc-1f1e62a52dc5", "comment": "Malware payload (Mirai)", "value": "6f25d5944076f7ec26f75fc4285fbf14c98788f939f7deddf48e07aaef848e74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806817, "uuid": "58d84627-f455-4d26-83d3-a7e5b9853d23", "comment": "Malware payload (Mirai)", "value": "996d60b20f4733e3809acb52200538139a2847c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806817, "uuid": "3ffb5fa5-03c5-4f75-b477-766e170d881c", "comment": "Malware payload (Mirai)", "value": "5123dc501ef68fdac6ee8e1108d6aeef2171aef725adfa371598ada7072cd44dd76597656307027885d69dc539993036", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806817, "uuid": "fec32414-2c26-453a-93b3-e777798cb69b", "value": "T121145C01730C0907E1532EF43A3F6BE193BFE99125E4F641295FAB899272E325585ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806817, "uuid": "6dfc40e0-03ba-491a-8e93-8b512c717061", "value": "3072:Z9p0k9+jlVFfMLVVIsSZVVhrZxN+cqTzOo5j0+KKcGWq:Z9pV9kfM4sSbrZxAcIzOQ2eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806817, "uuid": "e425b272-8c1b-4825-804b-a1ae1ea1ee62", "value": 192760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806817, "uuid": "f1080e38-e25c-468f-b10d-0aef635f8492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806817, "uuid": "3d898809-58c7-4284-8576-972e9d18ace6", "value": "nuclear.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794cb0e0-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826817, "uuid": "8fccb9bc-8110-4862-9898-7aa107e15337", "comment": "Malware payload", "value": "7b18a0da4d79e6627798265ba7f67045", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826817, "uuid": "0cdeb1c8-eaba-4fbc-976f-8f905c74b41f", "comment": "Malware payload", "value": "6f2fbf24347ce730e08b56c7cae6e497abcb6344201250a178f7c3b05d9f33b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826817, "uuid": "52a3d28b-eb87-403b-9989-c3e55a8f2f92", "comment": "Malware payload", "value": "3a6ef761852a486ff79c81205f3d2a3365bd5020", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826817, "uuid": "5007fcf3-df6a-4b75-8e1f-ac29f4818c47", "comment": "Malware payload", "value": "ea38dcd6f17edba5c147ac9907cd513ed27cc9d056c2f60fb804c069c8d70c4fbea46d116cff4d81791dd103d9632013", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826817, "uuid": "1eb54db5-b5ab-49f0-9ea5-53f536ce44a2", "value": "T186135CF61113ED9F8B2B0E41F40C1102ECADBC9372D954B8BF49469A4EE952C9EB8D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826817, "uuid": "44672b1d-5497-4d73-bfaf-dba6fb84d7b5", "value": "768:LP1XDSGXhiR3cUZvsSE+uRs2jBB33yHE9QQBj81shaG2sUq6SIcH+Vd:rx+GXhEbqCHE9QI81z7rq6SIcH+Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826817, "uuid": "a09cea90-10f8-4309-b288-da7d86cff991", "value": 44376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826817, "uuid": "0b17902b-bd55-4bab-8893-ef3c8e2f854c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826817, "uuid": "ef9b0a1a-8c99-4052-8001-27c212fe439f", "value": "6f2fbf24347ce730e08b56c7cae6e497abcb6344201250a178f7c3b05d9f33b5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680e7e73-22a7-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1773823782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823782, "uuid": "4bb2dc4a-b34b-48c2-a725-0f1ef5a668e3", "comment": "Malware payload (GCleaner)", "value": "2e193f264f74926bab324c7b6b8ef67e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823782, "uuid": "8e137546-aec0-4841-b804-d0f6790e5297", "comment": "Malware payload (GCleaner)", "value": "72b26d12682cfbb72a1c1e316122bf602b2853e75b7de1a059d8d4754b2d247f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823782, "uuid": "411dd27b-c5e3-4f75-b6eb-4d85c9606d4b", "comment": "Malware payload (GCleaner)", "value": "890f5ecad72e567ecc63e7a6adbda0f0a79b08b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823782, "uuid": "8cdf78e8-ab51-4e27-af63-310ff36e9103", "comment": "Malware payload (GCleaner)", "value": "d2f74941f6e21e3e70e3351c13a5b9f6b69b1ab20e67b39595f654c5dc5a6e61ae4fb1cb86f06b4f98e4402f90f998f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823782, "uuid": "87a4894e-6e59-4bd7-96e7-086e3e782462", "value": "T1E0F49E21A2B04533D1235B38DC1B9668982DBD802D24544A66E95FFD9FF93C1373A2EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823782, "uuid": "57d5e4a6-c2b4-4ac6-8945-91d1477484af", "value": "c58899cdef5ec886de91ba2c7e7217b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823782, "uuid": "440efa97-3b88-4204-bf6c-4aba3b6d063a", "value": "12288:d4dn1+NOdSXpYwSJlvZFFN1coPfS6sZMWS6/LZEgIHy1aoa+jLZIO:md1cOeYtJjFzbPfS6066/LZ31A+ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823782, "uuid": "ccc9f933-a968-4b33-b13b-acbc0db7d34c", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823782, "uuid": "04650043-3c0e-49e7-aad1-d03562be550d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823782, "uuid": "bdc4741a-72e2-46ed-8a68-b8767b281a35", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e090c-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827148, "uuid": "054d6068-e148-41bf-817d-cc1d4fb40435", "comment": "Malware payload", "value": "65ac45e1ae194b6525c04cfe6e55b50c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827148, "uuid": "b6930962-0534-48d0-871c-c9c1237ffdb6", "comment": "Malware payload", "value": "73389bd12ebb6a2152c636bed8b9d0538d6f4ee042033c9b51d991fe8cf73a58", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827148, "uuid": "c617d2ce-274c-4b1a-ba50-bd586ca6d1fd", "comment": "Malware payload", "value": "44d1c7181bc87559e2cd72c7139772868881e929", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827148, "uuid": "c364def1-c8ed-4155-a55e-c52b1c22b4dc", "comment": "Malware payload", "value": "7f0c32f2ade5245f978690e168202e0d3b68be5f3ae802b2d242055c2ea7727d63e05b9dd93ca869b7646f8f85a441b9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827148, "uuid": "d8629dde-d0f3-4d3d-91ec-c96455d900b4", "value": "T142350AF7CD05E5A56589E0CCE8C731A9AE08582FFA031CAB76D2879D84C337C99F9164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827148, "uuid": "c7379d63-3fda-4078-a091-20d2ff235dd1", "value": "48:vZDeL6DpHWtXClgf5g1PBHNlObLBxjBc/TBxTl5N/wlN/wCR/wmnunIuxlBr5fui:SdlIVqrMTQEZNFObSPPpeYJLpS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827148, "uuid": "2746815c-ac83-480c-a72d-6d1f6ad2ce35", "value": 1143973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827148, "uuid": "631503c9-0e89-496b-bf9e-ba0f96d77462", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827148, "uuid": "d368eb58-1de0-4b24-9193-95eeaf16355f", "value": "65ac45e1ae194b6525c04cfe6e55b50c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44093a45-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851639, "uuid": "b05cee9b-a6e7-4457-90d3-2500b67c7c51", "comment": "Malware payload", "value": "6b21e00a2df1bd2cbb9238ec421e50c6", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851639, "uuid": "e1bbbc45-8175-41c5-bfb7-f5ed433eb30a", "comment": "Malware payload", "value": "75cf4e8e85c9a0a695f47bd3e445925feadad4af6d18eb8d79e5437440ca9299", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851639, "uuid": "4cd87e64-d1bb-4f71-8a11-0993fbe1cb6c", "comment": "Malware payload", "value": "fe795f9a086a88c736783547203ca4b3ea4763c3", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851639, "uuid": "e35758ce-6e8f-4d97-8e35-5db351fd771c", "comment": "Malware payload", "value": "5db99ff6da87dfbe56c2241b4fecf34b32933dd34d12c448cb108ec74edd4ac81de439033a8ceaca79ded8eb25e09267", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851639, "uuid": "13f76c3c-5772-47d6-a650-10a70c76afcb", "value": "T18BC30160BA49780217BC711DF9CDDA12FC0E0A83477A960FFA1E4BF927AD57A0427B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851639, "uuid": "17daf665-f7ea-43e1-aee9-4c4a98316b4b", "value": "3072:nwSB9f5HUl88kyY9k7WNPZutOFvBvQjVFK:wSB9R5yY9oW1GOjojVFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851639, "uuid": "31b70741-ce63-47cd-ba6a-a048ac73d8a4", "value": 118304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851639, "uuid": "713e4e06-489f-41bd-a943-ff78780b19a2", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851639, "uuid": "1042858b-cde1-4995-8902-0f38f38a568c", "value": "1PhMAR17_Asssssss.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c21b90-2313-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773870317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870317, "uuid": "6148374e-db02-47af-a656-9a15483d3f32", "comment": "Malware payload (Mirai)", "value": "258e4699018765a3fc0269af667104be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870317, "uuid": "f426ae3e-1e4c-428a-a83c-7335a363f9ad", "comment": "Malware payload (Mirai)", "value": "7615cca387fce6392ce626d7b7dfa26d096222830b750ef1b61a0a6b7a56f199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870317, "uuid": "68fb8e23-b812-420b-958f-e63a9121609b", "comment": "Malware payload (Mirai)", "value": "e0a8af37414b73ac7613b4d48176fb98716513c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870317, "uuid": "c4d07358-a0f9-4d9b-98c0-6c0ebe210dc7", "comment": "Malware payload (Mirai)", "value": "8592f65856e86d5606d60efca0f9910aa2160e0395f954ebcb8dc046c80e41d1936a1463f7539dd5685fc5ef3f235016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870317, "uuid": "8901bb7b-8bc0-4c09-8faf-7a21524cc647", "value": "T141B33ADAF400DD7DF84ADB7B44534A0AB631A3A14A830F3B7257BD67BD310A45827E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870317, "uuid": "bc95cfa5-7ef1-4aa8-be42-d8c4026ef91f", "value": "3072:2b+CrK5Ay7U6CnT7bzcyAz1yDDw3WVvd0V/LP:2b+cCAyI1XcyApyDE3g0lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870317, "uuid": "74b8bef2-2de3-44e6-bea0-1f7ad2f271d6", "value": 108524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870317, "uuid": "c39c2de0-b04b-4eb3-afb7-7b6232bd1696", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870317, "uuid": "47258e7b-fd9d-465f-aee1-26a77b270d0c", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdbb3d1-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806823, "uuid": "414cecdd-6295-4398-a989-ee2ca4f9a4e0", "comment": "Malware payload (Mirai)", "value": "31f4dbfe3e9e43e7717e38bf04abb4b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806823, "uuid": "e575cdbf-ccb5-41bf-a2c4-def14f865ebf", "comment": "Malware payload (Mirai)", "value": "768120576ba26d8ba3790c99595f8979b3507ab85e357545ebcb624394a3b23e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806823, "uuid": "ff198078-2217-4557-90dc-78e610e73e60", "comment": "Malware payload (Mirai)", "value": "90d1080cbf98195694d693426bb3806fe9ec7cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806823, "uuid": "90107e02-428f-4084-bad8-8d5d6f0c12e7", "comment": "Malware payload (Mirai)", "value": "75b339042ece1fb4b2b08bd7cb14a2698da124fc5ed34754472d07d835735b80ae37578bbc55a67be0446f007cdf19fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806823, "uuid": "23fec252-c4aa-4fb6-b898-47bb93b3d6c9", "value": "T165145B45F9405F53C5D226BAFBBE828D372613F9D3EA71139D212F20378A46B0E76A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806823, "uuid": "1d17fdbf-254f-48db-ad5d-bda0d6ec5af6", "value": "3072:XDUg/oKWUUft8hW2zdMW5/WxcfL2/SJ54G8bPxT3mcweGcc:XDUg/nWFL2+WBfL6054G2P9Wcweg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806823, "uuid": "08574b3c-c904-4dd1-a611-edd6307c3274", "value": 194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806823, "uuid": "83909f9d-5481-4481-a2af-fa42b8d0d10f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806823, "uuid": "d2d3dd92-3c32-415d-9ced-db5832cd02f3", "value": "nuclear.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ab8882-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773828279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828279, "uuid": "9f37059a-6fee-4b3a-99e7-2b6c1d231f12", "comment": "Malware payload (Formbook)", "value": "3502a7c516415ebddfc23e2bc48e29a0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828279, "uuid": "0b86ed21-690e-4697-9110-2119e4450bed", "comment": "Malware payload (Formbook)", "value": "788919bf34d3a23ab0480f0d86627aed25101822f71e0c0037f09b0ced427a5a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828279, "uuid": "73733a05-94cf-45be-a0e8-d4aa56734a40", "comment": "Malware payload (Formbook)", "value": "bcc52e666569595823779653241aa493f09df096", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828279, "uuid": "a3fd4bd4-b22a-4071-a92a-cc64f6c3a406", "comment": "Malware payload (Formbook)", "value": "119d10862aefde4e9f4de16dcb8fb710d980befe69f28122d33652cf7f8be3c85038c701673918730478ea1a43b91c4d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828279, "uuid": "c9f6d8f5-3993-45d8-b49a-4d03d695bbe4", "value": "T1733509CB488636570EF9E2219FA9F38DB827E49244184C236B163A1E09D78DD5731BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828279, "uuid": "27492789-7551-4d8d-8834-15195023c0f9", "value": "768:KNYdTCntEwetZKJSOypGl1+Qt/Qs3+NG+YQpUzdrtY8yBgtgnnZOTtt2n5OqJZsZ:gd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828279, "uuid": "0e020235-18e5-4cdf-b10c-1b1b3c5963df", "value": 1070480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828279, "uuid": "b8e951bb-8408-4b52-bc04-fcee8989210b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828279, "uuid": "5a672fcc-6dd6-4f18-94f9-d4b63bc53aa3", "value": "3502a7c516415ebddfc23e2bc48e29a0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbac4d30-2314-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773870791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870791, "uuid": "7b51fac0-3074-4e51-a72d-8df34489f1bb", "comment": "Malware payload (Mirai)", "value": "cfec6239798b75691943751abe9ee405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870791, "uuid": "176db5e4-4723-434b-81c0-f926981e7d00", "comment": "Malware payload (Mirai)", "value": "79b0d1a5141e8a60404ed49692042d4053a69d842770ec654e017011bbd38a50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870791, "uuid": "9728783a-ba6f-45aa-86e9-2c62ef7ea142", "comment": "Malware payload (Mirai)", "value": "8b9a03cb1ee92b5a542e78b54064b1139a0031f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870791, "uuid": "8b614859-e0d2-4243-95b9-9fafb1801238", "comment": "Malware payload (Mirai)", "value": "1ac2a6e4285866935ca4e7b43a6bc3b2a462ae252f38f6e9221a374010b9708b652b3d4be8ecde98bff48627e6a48219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870791, "uuid": "3f542b82-0378-40bb-8760-366d2b28277a", "value": "T168B31846B8819B21C6C2127BFE1F118E331317B8E3DE72229D245B6477C796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870791, "uuid": "a73a6f3d-775a-4211-b728-222392388020", "value": "3072:ZluF38Kq9ouz7Gia8gRxhpBe6QKI6H3i:3AFgouzKiaxR3y6Qu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870791, "uuid": "d49c87ee-46c9-4dff-af57-7cfd93b361ab", "value": 112416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870791, "uuid": "5d820b9b-ceda-40eb-9fe8-ec910c02ce2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870791, "uuid": "5b55e29a-fe7f-4f0f-b827-c333883ba702", "value": "tux.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb21cbc7-230d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773867730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867730, "uuid": "7915dcf4-9343-459e-bb3c-3defb9a044bc", "comment": "Malware payload", "value": "612bd7dd56858d25fd5aa5f51ee36716", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867730, "uuid": "21df0d2c-1cdd-4d79-9cfa-5c52f3144fa0", "comment": "Malware payload", "value": "7a21c62b1e7840b36e00f8463ccf25b851b22ed1133e04ee63246c89a9003cf0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867730, "uuid": "a6461a67-030f-462b-803d-fdc14299d8cd", "comment": "Malware payload", "value": "1426995cf8d6c7ddc3a1cc429edbf43f66120ead", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867730, "uuid": "3d3f5d71-3303-4e83-9641-5f8744212d27", "comment": "Malware payload", "value": "d75ef2f96f66e3aea64f272cb9cf795c864df6483a68be4d1c0ba4e1626a09080543845c5a2a7e0ac45fa22e196a1a41", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867730, "uuid": "9637c669-2c02-4cf7-85db-3c64840483af", "value": "T18E8607EB2EA0A1E9F1A9C13EC0A38B0194F371771733C2E7659103659E0A9D46F7E764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867730, "uuid": "fe9267a6-e550-4827-ad6c-a5096b29e0fa", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867730, "uuid": "24e9ba53-a55b-4a15-bdcb-266d53a69aec", "value": "49152:MZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+91r9AE3meUEazSHjJm:MPOkz7MIvWeUFziVJHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773867730, "uuid": "3c295508-3528-4e4c-bea2-2b6307b0b69d", "value": 8534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773867730, "uuid": "50b7226d-ff47-4641-93c1-829ef964f93a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867730, "uuid": "11ab90f1-c6a7-4ebc-9ed0-2c427b6d7a30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abaa699-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773827169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827169, "uuid": "6a7158dd-2014-418e-a9a7-bc78e509a794", "comment": "Malware payload (RemcosRAT)", "value": "0d14ec8c80d33c420792d50575723b3e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827169, "uuid": "4a5e384a-e90e-436e-8aee-2cbf785e7bbe", "comment": "Malware payload (RemcosRAT)", "value": "7a35bb8a98321390a20f21890448b5ce19ff3c14d7a102ae714d911397220360", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827169, "uuid": "f3dbc4f9-1412-47e9-930b-cc16f164d183", "comment": "Malware payload (RemcosRAT)", "value": "52d04e17cbec6551fe1044dad12e39ea8a8ee365", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827169, "uuid": "7355d3de-9f34-40e9-9826-f14bcc8da979", "comment": "Malware payload (RemcosRAT)", "value": "57084c3c2c5ff968205f597b9211cc709fd66bed8de990933d9f6f1770d1719be6be059e96d72d12843de8d88a72ba1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827169, "uuid": "73fbe7c0-38f6-4654-a263-ec72dd2a7c2a", "value": "T168859C4362CBAAE4A5E51086BC7E4C324554F312E19641BF31D2DAD2EB73D00CE76DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827169, "uuid": "9bf428d5-dc7e-4d58-b3ad-7d0056ea4b45", "value": "96:FRo8b8c51x7+yQmTnqASgHCLBjgHGvocXkU3F8KrtRBK7ey9z9t000AI8nxt0001:iZ+ITHoee31j/tUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827169, "uuid": "657da18d-5cfd-44d3-a4fc-e294046e26b9", "value": 1824669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827169, "uuid": "bddb140a-caa3-44ef-a138-56005f5249f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827169, "uuid": "4b215f1d-b1c7-43f4-8055-176df6cf2f20", "value": "Remittance.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559483ba-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800988, "uuid": "b1364739-ede9-4598-af61-baa582145706", "comment": "Malware payload (Mirai)", "value": "86d38fcbc8b6761706b0cfaee51d9075", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800988, "uuid": "b14aa5a9-3e04-4e13-b3d6-503eb4889977", "comment": "Malware payload (Mirai)", "value": "7aacd98a9f47452b1212e9255d84d110a8644f82584d6502082416d1c7905377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800988, "uuid": "4368d478-583e-49bf-bae6-8dc232d94396", "comment": "Malware payload (Mirai)", "value": "cbfcfa6103b6628dbd8b1deab96382b133a5a3a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800988, "uuid": "9017202b-2729-4325-ace8-27cf73a3f83c", "comment": "Malware payload (Mirai)", "value": "eb27bec67084fb2daabb46295ee8a812102c843c50f5a6c030c11497516d1fff2b83bada402105e2113322a9bccc6a60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800988, "uuid": "40f74198-dbe0-4966-a0c1-380b21ceb418", "value": "T19A63A60AEF650EBBEC6FDD3705B90B0535CCA51B12A53B393974C828F65A50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800988, "uuid": "87a4393c-6240-42a5-9b19-98667ca80a2c", "value": "1536:vRuL1B8m/hO4I2rSlVpaZ13XJB+PEdKEEe:vRuL1BL72Za00KEEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800988, "uuid": "d9bd1f23-33d9-4149-8710-b49dc4161fb2", "value": 72476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800988, "uuid": "ecddcf6b-e9bd-4291-b568-7db5128da16f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800988, "uuid": "b5ca9ab2-8cab-4d65-89b7-a735033b8f51", "value": "dontcrynow.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c8b7c4-22a9-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1773824604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824604, "uuid": "5bab1e58-8e82-4066-b30c-fd5817c9e17d", "comment": "Malware payload (CobaltStrike)", "value": "b530d5d4f86533f71c33c1e7a49abf20", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824604, "uuid": "c522925a-b6ee-4d34-996f-a1f8e3e6df04", "comment": "Malware payload (CobaltStrike)", "value": "7b9778ed8559d714a26fc42c12a297658c8441ee790377944caa7d2d2eee06a1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824604, "uuid": "facf8df0-73b8-43f5-b1cb-c992dc8102e9", "comment": "Malware payload (CobaltStrike)", "value": "4d0edc94337076c1d6e3d16a5b6e39da17cabb13", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824604, "uuid": "b55b3431-5065-4bb7-83cb-881c3382cab3", "comment": "Malware payload (CobaltStrike)", "value": "2371556159e41f80be4d339f911db747fcc5ddc76fad907505b324a5d3fbbe4946f1680f9eb3c8538dd53685bf52ba81", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824604, "uuid": "211753c1-bc49-4f39-943f-40ffd9144c2e", "value": "T19B158DE0A69476DAC1BB9D3CC5867714D57170155320DBCB10AC42AE6E2FAE82E3B7F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824604, "uuid": "1342d216-65dd-49c4-b428-3e18d5875975", "value": "bcb6279034d7e809dbdb9a832073e963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824604, "uuid": "d5545aea-a720-4234-acac-e7addaa7a723", "value": "6144:bpK/NNyWLrz/WXoAPrmwt7WwsNrN01WWm+EhycZhKqjo1WHUHkNrjxS+ZCKfXT:9gNNymH+X3NK01fmdysFSjHYr5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824604, "uuid": "f8d8908e-0b28-4b95-b24e-648109a8139b", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824604, "uuid": "845edfb5-3a68-473a-9797-c626bb3be00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824604, "uuid": "f087cf8c-a307-487b-bf09-23225254f00a", "value": "7b9778ed8559d714a26fc42c12a297658c8441ee790377944caa7d2d2eee06a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc617a5d-22ba-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773832191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832191, "uuid": "5e326e10-bb1e-4db1-85a3-8ff9a7df4b65", "comment": "Malware payload (ValleyRAT)", "value": "68834870097fbbf5d674f16db92b9d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832191, "uuid": "963ab24d-fe28-4479-bbdf-6b4978c9a251", "comment": "Malware payload (ValleyRAT)", "value": "7c2a081ae59caa21bb4cdc56e7ce6f4fe947c75f5ee9a0411787930452cda6a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832191, "uuid": "27b3a9d1-f4b3-41d3-98dd-77c321629082", "comment": "Malware payload (ValleyRAT)", "value": "db201c504d2615d657b22e32a7023735792e3652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832191, "uuid": "582eab42-cf0b-41e3-a660-39bf649f387b", "comment": "Malware payload (ValleyRAT)", "value": "be732d0c2e599b1789488764d25fe8cc782bb6d8e7254c355196954387340840d076025234ffefe405e50d01dfd77bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832191, "uuid": "b5bb6f26-248a-4ae0-a6a2-4827e43c1e30", "value": "T1F6459D1ED68B92FDC51BD0F6E2268B7298317D08C374462753812B751E632AD9DBAF0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832191, "uuid": "4ee38e8a-0e92-4ffc-a95d-f0b548456a7c", "value": "d2eddd6214e50b2840380d8e7836183d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832191, "uuid": "0a6f9982-adaa-4fca-aef9-78a0603ab490", "value": "12288:6wwi4hmuCfdAF00KC1w4VzD9SPTbieD37OuBM1JhjMctug8WbOGl:yiN/fdAF00Kuw47S6eDuLdJ/bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773832191, "uuid": "e36111c8-9511-4d37-93c2-f05d483032d1", "value": 1278464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773832191, "uuid": "2d11ef94-b4ba-4fa6-a7ec-b6186d512c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832191, "uuid": "2b07d1b1-1dc2-4259-88a1-95b07cccd8de", "value": "2026.03.18\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6937b007-22d7-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1773844400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844400, "uuid": "eda82309-97c8-446f-9700-22cb6a937547", "comment": "Malware payload (CryptOne)", "value": "c7bfd771721cf5cd355074a5f8c30b4b", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844400, "uuid": "f4ddf743-be49-48ab-b0b1-bbe840796876", "comment": "Malware payload (CryptOne)", "value": "7c38b6a53dc9f2857a612896f1b8964ec02146d60be8455a641b3bb0e2f143f7", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844400, "uuid": "4ff05d5e-3458-4498-b7c9-bd579e41a841", "comment": "Malware payload (CryptOne)", "value": "c584af9268bb07286800aa46f8df191f43666c59", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844400, "uuid": "6a80cc34-c4f7-4554-8a07-517589b6e1a5", "comment": "Malware payload (CryptOne)", "value": "0506844fc0e4a967f516ee5193861883ee800e7085224e401cb301f18ff87db9c90d21fc2a819b3e7d8c8900a00f93de", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844400, "uuid": "027b26f1-f368-4e1b-bb52-e2be29c1742a", "value": "T1E356E069E280C62AC35257F89F14B398D5383905B9748FDD2E885BC90E3DF7D2427B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844400, "uuid": "a6090f70-53e9-4256-ba73-9cba38293824", "value": "bf8d88fb7815175dd959fe045f668096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844400, "uuid": "cd8c4e5e-c82d-4880-b2e8-b4d67cdc99c5", "value": "98304:ai86KFJ9l/MwPk2GAm/g4oTnxMrqhN13:aiKFJkyGBLoNlN13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844400, "uuid": "230019f6-9996-4b90-abcf-4ab84ffdb5ec", "value": 5979648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844400, "uuid": "459e7c2b-e68a-4646-abe4-7481a6ff991b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844400, "uuid": "42696409-e93e-4bdc-ac98-d996a3ea8c81", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d6fd6c-22b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773830461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773830461, "uuid": "c3158eec-1793-4d23-86f3-0fd137f1d80d", "comment": "Malware payload", "value": "3568842cc60f30ecc6b849910e4c686c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773830461, "uuid": "eb8047ca-d93c-4c94-8cb8-64f24c85c7e9", "comment": "Malware payload", "value": "7d70ea416d3ae180dd799422877d59179d8af34f24392da3b2e3088474d195eb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773830461, "uuid": "f8b8ade5-b1a0-40b2-8ccc-ec8ed35c89ba", "comment": "Malware payload", "value": "fafe266cc885f413c6590d47ad9fbb48645de674", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773830461, "uuid": "80b2a95e-a2fa-4b1e-b3d1-c80753f1102a", "comment": "Malware payload", "value": "b9a27455ac95d01625c5e535760632b37a89861bbdfc5349c05164d21fe2303ee4eeaf436d88f9260b40933bc9544152", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773830461, "uuid": "1e28f86b-55f9-4444-a0d2-5d222b887b1f", "value": "T1156733CEE874FA57E4AB4439C7B59A04C4367D7D995364223DADB21B693BE8132F200C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773830461, "uuid": "0f663394-870c-4552-b909-01a328e5ba38", "value": "786432:U9KzIDJE0OZSTok9mPhPJLqJsXLpcCxG3RY:L44STF9iRhcHhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773830461, "uuid": "a251fdbe-0f85-4aa6-ad4d-058ef3952588", "value": 29999104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773830461, "uuid": "b948ddb8-b1e5-4b96-b793-477bf852a6ec", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773830461, "uuid": "086a28f1-56ef-48a8-97ab-14bd301ada8b", "value": "Loader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb2b350-2294-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773815472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815472, "uuid": "29e06c4b-2023-4df8-816a-c2a552184eaa", "comment": "Malware payload", "value": "791140c1f30168412118a24e00bc69b8", "object_relation": "md5", "Tag": [ { "name": "metramon-com", "colour": "#9CE8E0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815472, "uuid": "70cfae35-1577-48dd-9006-9bb3acc75db2", "comment": "Malware payload", "value": "7daeeec6a883165d6849e0611e7fe39fbc4ad340bb2aeba416fb7cec3cb92917", "object_relation": "sha256", "Tag": [ { "name": "metramon-com", "colour": "#9CE8E0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815472, "uuid": "5ec20cbf-814e-47cb-8999-fcdcf728007a", "comment": "Malware payload", "value": "df20d30e25f8d50b88359e008ef1e1ce4338fc47", "object_relation": "sha1", "Tag": [ { "name": "metramon-com", "colour": "#9CE8E0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815472, "uuid": "1c2ca999-d55d-4966-bdd3-dad5433540ca", "comment": "Malware payload", "value": "1a61be42acf84eeddecfd09486d088597de912b2889ef0a76a66ec22942dc0475c889d326bc2f18a9a898fbc2f5fe095", "object_relation": "sha3-384", "Tag": [ { "name": "metramon-com", "colour": "#9CE8E0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815472, "uuid": "0e2d2909-7316-4114-91a2-fcfa38dedc7f", "value": "T1470110FE743234B26F4385EA9D5351970976D37F1BD02DAC28EA9B3415AD010B13222D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815472, "uuid": "33de08e5-b745-4410-b02c-9f35404f9f00", "value": "12:Sebh97dG3BCFrCR5VhFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:/9xdGxCFmP1EDlgNjTidGXhGIBFVR98c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773815472, "uuid": "77ad049f-e04c-46a2-ae45-302a887b9e1c", "value": 740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773815472, "uuid": "bbd7190f-240e-43ed-b2d4-aae858d8c9e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815472, "uuid": "ea41bcc4-a480-4621-86b4-5d6b4897dcf7", "value": "7daeeec6a883165d6849e0611e7fe39fbc4ad340bb2aeba416fb7cec3cb92917.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512b7136-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773851661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851661, "uuid": "20700057-9290-41ce-ab6b-2f3eebba26fc", "comment": "Malware payload (ACRStealer)", "value": "2232b8b5b21d34165ab0d1b2a7acc1c6", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851661, "uuid": "3edf2b55-dfa4-4867-a54f-8355c7a9a228", "comment": "Malware payload (ACRStealer)", "value": "7e3ca1c2bf63851dffece4155fd4b0c51fcf9b8e58121fcad1cfdb7e3c7fd3eb", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851661, "uuid": "76b9e9df-2733-4037-af12-0635fd99113e", "comment": "Malware payload (ACRStealer)", "value": "680b147bd8146348a915257194d3879ff848caad", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851661, "uuid": "bd10cc54-fa25-4801-b918-ed52d1ac9dca", "comment": "Malware payload (ACRStealer)", "value": "e0b2ab6cd9044d07c7a7f53f906f9ed1316b1ecc6f415dda2b261972173259c02379b8e059fefedb2fd2ff31cee77a26", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851661, "uuid": "d556af87-09c1-47a4-9f9a-d3827b9b46a1", "value": "T1DB553A46D1C56863D3B302735913E852FF39054626AA8C27B0ED759E3BA39FC93BB091", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851661, "uuid": "f7cb2db6-2207-45bb-b2e4-c5373d206261", "value": "18a574685822227273e6bf5b4d79df98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851661, "uuid": "e4ff10b6-859b-45ef-b515-739f815bba9f", "value": "12288:cYkSJq0jCb0wyJjhKAAFVdTPzw8yNKnbZIsz0VpN5Jyz+R1rv7uehrlIg5BLIJV:TkzytwvXdTPbyNDTJoqLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851661, "uuid": "37282871-24d4-4afa-aed4-4e3591081ca8", "value": 1403904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851661, "uuid": "f3d706f8-83c5-45c3-bbda-73420c8241cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851661, "uuid": "91158c6d-7b9d-4683-a5a2-79bf4f734b66", "value": "SecuriteInfo.com.Variant.Fragtor.934082.12543.542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27e8d06-2314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773870803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870803, "uuid": "cd060922-edd7-4509-b8ba-146d55330176", "comment": "Malware payload", "value": "a7d6a4d5ac903022a6004233e1632dce", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870803, "uuid": "1c40c64e-b25c-496c-a536-66ff61457897", "comment": "Malware payload", "value": "7f0fa4dba8c4bc64f204db88faea3031e1619149c556028ee4a80a7adae42f50", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870803, "uuid": "516d193e-628a-4e32-b794-3441f2b25b9e", "comment": "Malware payload", "value": "feb2d09c8f2b37b45f3faf2847ce5bc92df8ba05", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870803, "uuid": "20c1c8ee-d7c1-49bf-8203-e2435f7d1ce2", "comment": "Malware payload", "value": "b5dec1747d4dfa345e8c895b9cdb97c3ef3f97cc5fab3e94b4b5a43df0bf1ad67754c37977b6358eec808079bc0cd424", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870803, "uuid": "3894b471-0343-4765-9994-4cc7cbc3745b", "value": "T1A886F76B22A381B8CD59C7FEC0E28A00A5F3B17B5733C2EB559D03654A45FD15E3BA60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870803, "uuid": "47e37bb3-23f1-4db5-a391-3f4119b4ad64", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870803, "uuid": "44bff7f0-0d97-4420-bbd2-ed4235fe386a", "value": "49152:bZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+9er9AQT7PRANF2ZYDh:bPOkz7MHtbNCDrtXSre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870803, "uuid": "354d5322-8fb3-46e7-b921-d96b544a32bf", "value": 8372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870803, "uuid": "902bb18f-71b1-40f3-bfed-d05b9c5bc01c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870803, "uuid": "c4a8603d-5c36-439b-9e74-a4c4bee0703e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5e4192-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826823, "uuid": "7c5326a5-a2f8-419c-acf1-ed2e3eb2a30b", "comment": "Malware payload", "value": "4fa11dff8997c9aae0ed721991d72510", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826823, "uuid": "a5b158e1-999b-4b13-be4c-af2c99ef38bb", "comment": "Malware payload", "value": "7f3611d49d9a05d5cb2504c77f3eb91df5f213b3a9af91978f5b9ee421679226", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826823, "uuid": "cb5e2beb-b43a-47da-9d9f-2033bdf206e8", "comment": "Malware payload", "value": "a046d14197c505b62b356be9dbcde569e474b57e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826823, "uuid": "1ca54065-f4a7-4905-b23d-da1ba14b427e", "comment": "Malware payload", "value": "01f944e291c7733e36f315bad799187d97e1028435ade3e67bedb8e74d62ca99447b9b917ddb57cd719cb4a4e8648e51", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826823, "uuid": "f1b6272b-0ab5-4c6a-bb09-b280d9148c6e", "value": "T1F0134CF61113ED9F8B2B0E41F40C1102ECADBC9372D954B8BF4546AA4EE952C9EB8D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826823, "uuid": "ff0992ab-4ec0-435e-8ef7-f0069749645f", "value": "768:LP1XDIGXbiQZn3cUZvsSE+uRs2jBB33yHE9QQBj81shaG2sUq6SIcH+V7:rx8GXbLnbqCHE9QI81z7rq6SIcH+V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826823, "uuid": "30584ad8-6d0a-4934-985b-18aa6a4559ad", "value": 44376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826823, "uuid": "737bdc51-b8cc-47da-a9ca-b1a04ff36622", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826823, "uuid": "fea1c49e-4ca1-4721-854b-5effc57945de", "value": "7f3611d49d9a05d5cb2504c77f3eb91df5f213b3a9af91978f5b9ee421679226.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bf0343-22ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773861602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861602, "uuid": "855ccc83-eb5d-470a-bc19-ca99244bb080", "comment": "Malware payload", "value": "096eb57ac66496d34e2227df23ef65ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861602, "uuid": "b87e68ba-9711-48eb-b6f4-0d6e898afab5", "comment": "Malware payload", "value": "7fd1f37f932a6959b1ed801cb97c1971339b9fe01b29a091ca7d44a49969e758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861602, "uuid": "4626a68f-3c78-4f6f-bd3d-80a8173ff18e", "comment": "Malware payload", "value": "f553104a9c5f949e8bbb709c4dc2624f78b7e184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861602, "uuid": "7149d2c3-27a3-4562-bc29-60154b2e9cfd", "comment": "Malware payload", "value": "4b8efa08e39a05d94ae1a5f9292447e32d0813fe6b7c3e34e1605da6122117ed5f6f32e10ffaf4197e6dac2cc7c288c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861602, "uuid": "356fb445-d19f-44e0-bd4a-1a21cc232f64", "value": "T1CFC622E91AD563B490D24500728B839E75C2254D86FD5C2E3ED73C412728DAF268EFBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861602, "uuid": "603ae7fa-ec8d-4176-b9ed-284cf9445e0d", "value": "4fafa4097dfb7318c296a9989e1ecb24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861602, "uuid": "df1bdc51-20e9-44ad-a5a7-db00827f78e1", "value": "196608:NxXyFBC/b8PNA7p8Eel1ssniT73Qgf3+VOa3bnOJrNYBhMxRUWfKmU2:6Fgj8lE+1ssC73QKEbMnKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773861602, "uuid": "e47e8871-65e4-4f47-a2d4-58a5a821f145", "value": 12483024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773861602, "uuid": "2845e874-c4ec-4f4b-b4c4-65bce536ecad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861602, "uuid": "47fe6b41-296b-4b34-9404-bf89612e2c2c", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f34587-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (ResolverRAT)", "timestamp": 1773827592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827592, "uuid": "d5d22182-fd5c-4ab9-8bd8-976c826da96f", "comment": "Malware payload (ResolverRAT)", "value": "e12afa346332b60238a927d122e62fdd", "object_relation": "md5", "Tag": [ { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827592, "uuid": "c9f02f81-9cf8-4667-8b88-cbf844266a47", "comment": "Malware payload (ResolverRAT)", "value": "81d11ee5c84e4ee453eb9d95285c843592c61015d2712319c9910fb63ab74fe3", "object_relation": "sha256", "Tag": [ { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827592, "uuid": "da982f33-7e1e-4d94-b271-81afb8f6b485", "comment": "Malware payload (ResolverRAT)", "value": "cffc97bc7de04ae2fb9dfa705157f9686d8c79b2", "object_relation": "sha1", "Tag": [ { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827592, "uuid": "a5df7cd4-ca67-426b-a98a-c03561633505", "comment": "Malware payload (ResolverRAT)", "value": "7023778cf7f0af938cb89f6408b3d7606652f6fdbff4e847dc25fcf7bdd08e115fa4229efc2f8d3778bbdf665fa17f8f", "object_relation": "sha3-384", "Tag": [ { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827592, "uuid": "931c3b41-14b7-45e4-aab6-9a13325b06b2", "value": "T1165502AFA03771BEB60D36CBE15A02635B91FB9DF71A7DC8709D22AD440C0324A8D4B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827592, "uuid": "a1375277-370b-42e3-bd13-9773c3c0710d", "value": "192:R3DEF0X6Q7VqFkPv2WamkYhEbXRO2ELTwcS:R3DEF0X6Q7VquPv2Wamk+EbXRORLMcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827592, "uuid": "7ddeca1e-c270-45af-9361-c75d0c05c142", "value": 1350717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827592, "uuid": "365017da-56fc-4481-9afb-84f8bf3f40eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827592, "uuid": "7a813917-5fd4-469d-9451-bfa69bca0d28", "value": "e12afa346332b60238a927d122e62fdd.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755d45a6-22bb-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773832394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832394, "uuid": "5a8e5242-fcd3-4f34-a463-d29f22b5df95", "comment": "Malware payload (ValleyRAT)", "value": "fe5fed2fa9e613f24a678ddef2024e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent!MSR", "colour": "#E4BA80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832394, "uuid": "7d5ac2cc-698b-4661-8f1b-9dc4e23d8f01", "comment": "Malware payload (ValleyRAT)", "value": "82135c88fd0af3de7551f55d6cf7670e206b9383fc0a0d0b4166fbbc8c5ace27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent!MSR", "colour": "#E4BA80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832394, "uuid": "f0dfa363-c52c-4313-a5f8-f9e23e931f85", "comment": "Malware payload (ValleyRAT)", "value": "4ad64c3ce568608b15a70965cc6d1d2913ea526e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent!MSR", "colour": "#E4BA80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832394, "uuid": "e886ea5a-efcd-4e97-9f4c-e9fdd8b2d560", "comment": "Malware payload (ValleyRAT)", "value": "da824e0f9e9c567514383af79d2386d32a6d0b076458dfadecbcd55760f0163064c5dc2e789a6adc54d7be916ad10603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent!MSR", "colour": "#E4BA80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832394, "uuid": "a999280c-1937-4145-a977-36ac454288ec", "value": "T110633A6274DA8133E89362BD0FFCA2B1559EBCC0137640F374881BED97B52D58A39366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832394, "uuid": "db46d5a9-8963-4070-8cbe-d5bc5deb0be6", "value": "7aea8e332d822b58214e762f4410c778", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832394, "uuid": "69376830-bc46-4810-8215-e603cf36a1e7", "value": "768:Bzev78tXh0sag+76i41UT3Ch+Y8SRrFj0OkSRUpED30xJHOLBpKC:BzPX+Le+oJ04RUl65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773832394, "uuid": "aaa63568-3298-4382-a353-0aa1ce1fdd85", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773832394, "uuid": "b86b0fa2-bd2d-427b-88a6-f6ad53cc60bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832394, "uuid": "253402fc-a664-4fe6-befa-c49b1bc0e533", "value": "asdads.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f7fd1e-22a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773822510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822510, "uuid": "c774bbe2-8d55-4f7a-a3b3-4de1615013e7", "comment": "Malware payload", "value": "c91de54eb05d3bfb85d9700092dada24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822510, "uuid": "f205aa52-8e7d-424a-aabc-011bcbd69d7b", "comment": "Malware payload", "value": "832459f4d6704ce801a8239f2b0ea44486434df5c1d6a52e40caab3970a5e6e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822510, "uuid": "94a7023f-6e11-4cb3-8a48-c594fb24fb61", "comment": "Malware payload", "value": "f6df6e9f1ca806a95561b47225e38612fbc0b721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822510, "uuid": "525a6566-0afd-469a-af1b-4c6f54dc7a80", "comment": "Malware payload", "value": "b924c68b3cdfa90bfb97f74c6ed1f8b64279e7024536442929d07cf95602a7cc7dc93d7749fa86e544da3a33da5aad51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822510, "uuid": "9a1d71e2-446d-4cbc-84a8-252ed4e5ff33", "value": "T17CB5334344E9017781F61BCC0827B39FE46D3E390B69B156EDC86A54C5BFE68EA23358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822510, "uuid": "0acb9b66-c11a-4697-a122-93ab0d0fe4b3", "value": "49152:FMkE1cklH/JgePJWcA3081shEVIrkxRsnmk3U3MxBRlTn+Kv+8:FH0lJWzk81sTesJU3MNT+6+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773822510, "uuid": "61175d5c-ff1e-4851-ba5d-3233c86ff966", "value": 2457648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773822510, "uuid": "bf5b1e94-5d90-4dd2-914c-2967a5c8aaf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822510, "uuid": "1a8afdc3-a380-4f99-8d21-9e9f487503c1", "value": "ethd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66989ded-2274-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773801875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801875, "uuid": "71d22a31-d5e5-4adc-b97d-7c10be729ddf", "comment": "Malware payload", "value": "db29c217807f7b8a827d653827b12fba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801875, "uuid": "b0287446-8db9-4237-8c64-aab4f67870ab", "comment": "Malware payload", "value": "838622a264b15e8426ae6ff503dcbb3b89588ae3b1362cfb5e3cd7640a64253c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801875, "uuid": "c06f41c2-ee83-485a-8f8f-8706c0187c90", "comment": "Malware payload", "value": "09b347cf4fcbc65a99e3d0f8fe33f867c688120b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801875, "uuid": "39b2d372-3166-4b8a-b8fb-c81515c336ce", "comment": "Malware payload", "value": "c1d6663e8a8a4a08b98c2f4a1dba70b8953e0c2cee3e9b8dac3f50f7a0698930bd284c10c9ab7625432f1401a43f5f75", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801875, "uuid": "268c5eae-8bc3-4fc7-aa37-933774c8f152", "value": "T117925CB512896C79FBD0CE39AF3C6F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801875, "uuid": "aa6216c1-b8b7-4349-abcb-12ceea1b754b", "value": "384:CFcuQpWx+BL0SWL0gLzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:CF8i+BL0SI0kzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801875, "uuid": "36b5cb0d-ca92-4ce8-b63e-dafbb4f4c07a", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801875, "uuid": "a7569834-d01f-48ef-a552-01a6221bee91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801875, "uuid": "2ce5b847-6d8a-4425-b18f-2a3b337adbb0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad474ad-2266-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773795977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773795977, "uuid": "06f98d8e-fff0-4145-9694-d18526b31f6f", "comment": "Malware payload (ValleyRAT)", "value": "afad28ede93f1fe8a296ea7f47835a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773795977, "uuid": "02a6b928-7258-4a8a-a09d-be47a363da24", "comment": "Malware payload (ValleyRAT)", "value": "83b045a0f0ae7aa319bec1b98d780c0080363d50d87aab9228f1082d21a7d361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773795977, "uuid": "61e7246a-a20e-4323-abde-fbecc8e374e5", "comment": "Malware payload (ValleyRAT)", "value": "a699788cd74844d54271a3872e03528a8a8c9d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773795977, "uuid": "0e37f592-8d67-47dd-adc3-4fdfc8d7d598", "comment": "Malware payload (ValleyRAT)", "value": "1a5ac50681ea457f17a7b8227b891a926e4d1d90ea8587858ffb1445166c261ee61d755b7b039791fcc5c39ba7f0899e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773795977, "uuid": "657d6480-1dc5-4415-8002-732b30eaecfd", "value": "T1A1E40201FAC689B1E53E09315D1A7B11A57CBD201F14CFAFA3E87D6C9A704C19A25BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773795977, "uuid": "56182308-fcbe-4059-9c30-fbc71d08ba36", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773795977, "uuid": "765c58d2-23ab-4880-87af-7539f594bf98", "value": "12288:acrNS33L10QdrXRMQYeVn7m0bcjFGUFRUR/95+rTpF/UssNNoT:RNA3R5drX/YeVqECFGSUR/95+pyssAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773795977, "uuid": "d7f171e4-63ed-4928-b3eb-e3bbdcdd9d56", "value": 709320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773795977, "uuid": "1c11e6db-c551-4509-8116-dc7f4f7540b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773795977, "uuid": "2bccb149-a040-4b1c-9e30-64914f977999", "value": "AI\u4eba\u8138v3.2.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373d769a-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827566, "uuid": "7669a435-427c-4f54-9230-311cfd9af04a", "comment": "Malware payload (Formbook)", "value": "7663d7ba5e3d09cfce65c863225b369c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827566, "uuid": "cd9a3787-478f-4474-bd6a-0f302c334d6b", "comment": "Malware payload (Formbook)", "value": "84c10bec9bbe9da56f463a912e938bc3308c0d9fd0bfd298c0f3a8b01052fe0a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827566, "uuid": "105210f6-e7ef-4e29-baa7-90e8deb04724", "comment": "Malware payload (Formbook)", "value": "7112268545ffd2079ee5b484e49d90286d5377fd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827566, "uuid": "c2af986c-df46-4a62-9805-e26937ae7124", "comment": "Malware payload (Formbook)", "value": "fd67ec90fe23fece59e2e95c6a75332eeb1de825a34f83aa5bfb583f6dd984a9433cfc41a0ad7409005d7723054f9ea4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827566, "uuid": "c60679e9-d5b6-46f8-b94e-b8a8c05ef262", "value": "T101C5A7041FEB84DE31A37E2049E0526B5A7BFBB765B48B9B048103CD0BF3948555AFB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827566, "uuid": "640942eb-7fed-4650-8fbe-fce129fea3ab", "value": "24576:QXPp+zIuiq2l+BBsL7zBGPxsjgBDcDc3n:hSsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827566, "uuid": "c8d6ba81-3c3f-4b5e-8b7e-ecc7269562df", "value": 2609484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827566, "uuid": "f67ddc13-02ab-4790-8476-f0d3e6f6ba83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827566, "uuid": "086ae558-6da8-47be-9854-5d4354a3a008", "value": "Attached Excel BOQ..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1458f4be-229f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773820206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820206, "uuid": "1480aafb-1ecb-4441-94e9-85be613086b3", "comment": "Malware payload", "value": "761425ac5b2c5f53d469996352d76dfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820206, "uuid": "1f7871a4-0987-47ae-a706-8653913e084c", "comment": "Malware payload", "value": "84df0c6c6e9f4b045801dd85c7637bbae39fd3386c35c1696972e5ba7f48489e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820206, "uuid": "4e2662fa-bb8f-4428-baea-44e3ae8206a7", "comment": "Malware payload", "value": "ccc2201e4d79410c678bc57d7f6cfcdb31bdc4d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820206, "uuid": "d88e8321-dedd-48d4-baf4-61cf8992bd1d", "comment": "Malware payload", "value": "bf4fec6f938d54a6673c3e2dce5281f5f06214114868d840f63c96c16df56ceb8d060f187489ca6948e1e5b85a4985f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820206, "uuid": "7c3dcc28-fa8d-4110-b778-d9984865adcf", "value": "T17396638FB2748613C8E263B5B2063572BE2AD435479983777CEDE435319F0BE4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820206, "uuid": "229ffce8-0e9f-480d-902b-f383e02a1986", "value": "3fc31f00ce7bec32061d57602f099359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820206, "uuid": "e9de5e20-626b-4ded-9d10-7aef72129ca0", "value": "49152:/6C/6RFnzlARNV652Bfn3DP0NrUEDsxS7bGfzPnpb19vshyLKSFA966toZEZytnH:/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773820206, "uuid": "712893f0-c40c-4b16-a6df-6beec06d556e", "value": 9195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773820206, "uuid": "37b157d5-d5e8-433e-b11e-c2f52e238295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820206, "uuid": "e57f775f-ded6-41b3-851b-6d32bf1c7dcc", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfa5491-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827575, "uuid": "72697e56-c9fa-4fea-9bad-95aadefe6245", "comment": "Malware payload", "value": "551c72b95de07f920ee75b6fc933bb63", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827575, "uuid": "00bff82a-3103-4fe7-99b6-bb4a486ee361", "comment": "Malware payload", "value": "84f27802a45c671beea796ba7230563bd374bb792d9b4e47eb283d3edc186837", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827575, "uuid": "e19dceb3-4056-49dd-b0f9-829dd49f80e5", "comment": "Malware payload", "value": "decd5dd24d39b1a2e7aa6c3a51c3da6f17b10d13", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827575, "uuid": "8a60dd39-667f-4c99-8fad-22ee88ecd385", "comment": "Malware payload", "value": "8201237db6c069c5c427d805f0ef1584aba15e39d9128b0257ddea63293801683d97e95018d2594d6c08a5863dbee0ae", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827575, "uuid": "e5a82e7f-0fa6-4f09-b117-166796aef5d4", "value": "T1ABA21D3EC985DFF00B6A31E1A56F791669140363B4397E4DB9CBC0A93B356108BB14EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827575, "uuid": "fc45b2a2-1cf1-4ab1-9905-aa9e074a8f09", "value": "384:KQFsazdlF+DttCmXCOUScCJXJPMjcTho3T+ppkoGP4srDwLmMWbxw5KJ7vr3cm1W:KmzwvCxdC9fAWpFU/i5WsBKI89eUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827575, "uuid": "b18711d9-ea04-4058-bf6c-fc4a66eded32", "value": 21991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827575, "uuid": "d887329e-5ef4-4276-bb31-b70b22358173", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827575, "uuid": "bf0d1fae-ab86-4240-a981-a8b239442e53", "value": "551c72b95de07f920ee75b6fc933bb63.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e47a2cb-2323-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773876943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773876943, "uuid": "512fdca8-db94-418b-ac23-671623ed72fe", "comment": "Malware payload", "value": "994c0f0e110c35bb881a8d6a98eaab40", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773876943, "uuid": "4355f58e-e316-47d2-b264-a6a353a09083", "comment": "Malware payload", "value": "857ef0245d9f0f6782b8349cd3982d9400fa5100b1bb8b2197d4610b63d1da11", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773876943, "uuid": "30092b27-dfce-4c98-9b00-25d3483c3629", "comment": "Malware payload", "value": "cfdc4a866f958e1efa4fbb1b79a1b5e2ff9ae039", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773876943, "uuid": "1c96248d-080b-493e-9c42-c2d0242f4c48", "comment": "Malware payload", "value": "6460110f0b0d09aadd8fd1b9a98c5ef74e55e1b7ff34787074d7eead4f1296609ede97ebe45a230fd4798a1e826190ec", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773876943, "uuid": "0c106044-8962-4b45-b611-ed7ee6f2079c", "value": "T11AD56AA07585C032D56D007AD928CAFA116B7E63EB7D44D763DC7E3E3AB19E14231A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773876943, "uuid": "b2f41ce4-c207-44eb-9358-49405f8b0e6c", "value": "49152:V2NJrMf+7UVZDEFe1qYaZrf5jSTUialii4vLNgmUESIEjPMN2lv+oBtYRMV3eVoW:cq+hjSTB1i4veHjPMNaJYRMV39qAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773876943, "uuid": "f7c0dc7d-9438-443e-bbdd-d62a40d84f50", "value": 2878464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773876943, "uuid": "bd0dc0f1-0aa6-43be-a32b-ac9a38fd22b3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773876943, "uuid": "f3ea2201-d0e8-4621-bb67-87431ad6a051", "value": "resources.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848cbe3f-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801496, "uuid": "0dc57448-9c98-4a4e-b1c6-b8c189dcfbf8", "comment": "Malware payload (Mirai)", "value": "919f54cc4434ee0c336726ea6b511184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801496, "uuid": "82da5738-dc07-4efa-88c5-eb8a9d644038", "comment": "Malware payload (Mirai)", "value": "85fefa20f86c86d6883b993b2f2c985421e001726d811664fa22278c2789301f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801496, "uuid": "99b5569c-fe19-4e2a-90e8-b219eb24feb5", "comment": "Malware payload (Mirai)", "value": "9e915167974ed530f78fa85766441036dcee5648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801496, "uuid": "9f5e14a3-e982-47ca-947d-416bab9a809a", "comment": "Malware payload (Mirai)", "value": "67ffddcef92b3c85729190b4af87eb97c1767c6363cba9e326394035020a5d13ccbdad0f65f742911afdcbad4bf8cad1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801496, "uuid": "c3722631-e5f8-4f0f-a174-11865f12ee46", "value": "T14A03E892B8824A6BC2E023BBA67F518D3361A3E8D2DF7357DC215B40BB9541F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801496, "uuid": "08b794aa-8094-4b09-ada4-8e3c2227e19f", "value": "768:NomGn/aenqIF6reiz9XdK39xo2K5HyEfHLr1GMke0/Ncus/1bkU:+/znP6reuKQ2KJrr1x0Wus/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801496, "uuid": "61e34a9f-712f-444e-84ce-b7266181afd1", "value": 40520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801496, "uuid": "5ba207bd-4ffd-487a-bb7a-fd65e574e042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801496, "uuid": "cd89499b-0587-4475-939f-922da6bdf6c8", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ab542d-22cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773839891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839891, "uuid": "d1b9590b-52e9-44d3-8087-e2cd413f63b0", "comment": "Malware payload (Mirai)", "value": "9052148f17ac45d34ca0da1ee566c22d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839891, "uuid": "b64dc577-73b2-42df-997c-59d522d83c2a", "comment": "Malware payload (Mirai)", "value": "874bb7b208223c9216400f6c4771c8bd7bca941a58f8ee3de1f4583a611e1b95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839891, "uuid": "eaf43b6d-12bf-4cbb-a9ce-4aa1bfddf3a8", "comment": "Malware payload (Mirai)", "value": "678227803972d5cc9573b8f4e0dab2b4a8db95e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839891, "uuid": "b810924f-73f0-42ff-85ca-df97087203e8", "comment": "Malware payload (Mirai)", "value": "1ecbcf5f7f405d1d11b19501b8c1adcc2c158f70262051f4a04cd55584af16ace2a6d676eeea52d301b85aedc1e56348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839891, "uuid": "410508b8-483f-4020-8fc7-1f5b8c7ca78e", "value": "T1BCC44A55A8419795D1D02BBBFF1D934873131F38E2EFB1069D096F246AAFC1A0FBA502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839891, "uuid": "20f35313-065e-4139-8969-937eda7ca348", "value": "12288:1JtE1fCmxndiXMSGGHCT/V19EGK/RE8vfB0Dw1GFNzdz4o9R7:QdiXaGHCGO8vPGbd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773839891, "uuid": "da4010fe-780f-4605-ac29-62c559bd70d9", "value": 555748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773839891, "uuid": "6df23133-5064-4552-9039-2dfdf9b3e939", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839891, "uuid": "d831a50f-4d31-4fe2-b84c-83eecb60bf53", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75c5490-230f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773868636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868636, "uuid": "282b969e-e2ce-4a23-83b3-2a6452c0e536", "comment": "Malware payload", "value": "6f54ce577425c4ddf5ad9870587e209e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868636, "uuid": "7ab203cd-218f-433b-9043-6c780e8a5f7b", "comment": "Malware payload", "value": "88319bc8a770172b79105e4548de009692a46ef19c3ba93a859685bc777d6f46", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868636, "uuid": "778cc921-c00d-4d22-bc3b-84155a15a720", "comment": "Malware payload", "value": "efbbdc98dd0ba3c1c12a40cb34c005f002ccafde", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868636, "uuid": "944799a5-c983-4d0b-8b41-225c783948dc", "comment": "Malware payload", "value": "d6a1cbd8059f660d9665c045f57758d921c9cedd7f1c95b8c0e0634f2d73338d8e39a13952f3a88a9719e16d3baaa235", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868636, "uuid": "91824653-6026-4f26-b88a-225b097c6267", "value": "T127925DB512896C79FBD1CE399F3C6F4CADE4C2C42124A3ACBA4F39215A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868636, "uuid": "ce4d97ea-f8de-48e6-89de-a51b14fa7dc3", "value": "384:fFFcuQpWx+BL0SWL0g0zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:tF8i+BL0SI0HzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773868636, "uuid": "9f67b999-0b97-4feb-964e-47a507940a2f", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773868636, "uuid": "5ede0e58-e497-4062-bda0-bef2b53dce91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868636, "uuid": "9d05ff99-78c5-40e4-9d52-522cf375634d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6edf8c-2313-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773870313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870313, "uuid": "4c90850f-c16c-459d-a410-ce536907d108", "comment": "Malware payload (Mirai)", "value": "e8602dbb3bed5a5bf3884bc94cf48b22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870313, "uuid": "b589dfdc-ee54-4415-8069-85f62f1f1bb1", "comment": "Malware payload (Mirai)", "value": "8854aa073dc916da1cfe5f9f167bb3080d4efeade4bc4e5f9caf33d7a25de842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870313, "uuid": "ab1b70b7-ac86-47da-9048-9de656458cbf", "comment": "Malware payload (Mirai)", "value": "7634af323d2ce249c5a35731d1b1860c72205cd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870313, "uuid": "05aee8f1-5ead-405d-85d8-06ee08406cf9", "comment": "Malware payload (Mirai)", "value": "218d64c5b4e695a7ae0a6de9ac9b99bc5d4341154db92a9a7944db6baa49a27335a73fcb86b86d5a0d871892d2f6f5b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870313, "uuid": "dfa79bcb-23ca-4019-b345-e383f27598cf", "value": "T1EBA34A82BC41AA22C6C11277FB6F018D371613A8D2EB32179D299F6077CB91F0E77656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870313, "uuid": "fec0f0cb-18a6-4c51-88f1-24080e6103d5", "value": "1536:2GhiLk73ayCxVlIYSrvY2/Ax/M/Jf48nhX4rCq7xpyUJQZiaeNrHO7trU3b7dKwv:2GhiYjayZ3vDKvGOuOxX2Ziac5QGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870313, "uuid": "a70fe14b-8e9e-4f83-936e-86949d05520f", "value": 99480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870313, "uuid": "71e487e9-874e-4a11-981d-014e44974967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870313, "uuid": "edd123f0-fc1d-414c-9191-7e5fa64073bf", "value": "tuxnokill.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ed7e77-22dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773846674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846674, "uuid": "b02d6c92-40cc-43ae-9daf-ef2d58b58ac4", "comment": "Malware payload", "value": "1a26241e24063b02157cbf3709e7eca7", "object_relation": "md5", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846674, "uuid": "daf57e68-5c81-4705-96c2-de1c6c5ebb31", "comment": "Malware payload", "value": "8863478954faa0822dd238b24d6e04ebbe4f8aee2e3e24d0c8351e996a7a9c91", "object_relation": "sha256", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846674, "uuid": "68d815cf-94a0-464b-9759-b89260b694c8", "comment": "Malware payload", "value": "fbadf3c0711f360260f5d00728645d03ca97f07a", "object_relation": "sha1", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846674, "uuid": "e22a1858-56ef-4aa5-9618-b38d2001748e", "comment": "Malware payload", "value": "a1063d18b75bd7aa7e86cce087f127f37a3f03b6c054cb709c5e98922a4d56a189a50d00d2aa498ae6178e62c1f24535", "object_relation": "sha3-384", "Tag": [ { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846674, "uuid": "99b743e6-5664-43d8-887a-711f35d6b0b9", "value": "T180C02BD40D17E3415089E3070030F20470D000060001D1DB0F01466BF4D68D0840C05C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846674, "uuid": "671e1c03-32cc-4ec8-816d-46ecde8cf774", "value": "3:lP/ErUoNMLM2IEIE5+AVpL18P53yoZXVchV7W6WFL5vhc7yn:lP/ErUoNKMMaAVpL2pyGXVq4Jc7yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773846674, "uuid": "d00996de-43a4-4d34-9d94-083c9aea2533", "value": 131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773846674, "uuid": "e530727e-709b-4ebb-b639-46ab67af32fa", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846674, "uuid": "9f0328ba-0683-4d10-be4b-76e8937fe626", "value": "Re_06430927609432.pdf.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eb4ccf-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827649, "uuid": "eba3ae8f-2543-4f54-884a-74ade46894e7", "comment": "Malware payload", "value": "5ac9f754f3edc409dfdcf2130db76f83", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827649, "uuid": "e4a481f4-2bf4-4756-b603-c6cd124d02a0", "comment": "Malware payload", "value": "887b96afc1ca21d53fcb21f6e95396b041ddeb34db4b1682ece4cd5a3abe56d6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827649, "uuid": "b34a0521-7866-4980-84fa-1c4996e08d0f", "comment": "Malware payload", "value": "ec026bd89e53786e4c6a3030a51ee364117c05df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827649, "uuid": "1fa1a635-4455-4198-bda9-78622deb152d", "comment": "Malware payload", "value": "1e2f5d1ebfe0b2aec7341bc1bd9acbf7971fd973736fe59bda017ce089e785436418ac65c41813e04bb262d3498f18ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827649, "uuid": "879189f8-dd93-48d9-94e7-ee31fa1d8749", "value": "T129925DB512896C79FBD0CE399F3C6F4CADE8C2C42124E3ACBA4F39205A1166DC70534A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827649, "uuid": "334e1e27-4545-4f25-a6fd-dc62eec78931", "value": "384:wFcuQpWx+BL0SWL0gMzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:wF8i+BL0SI0XzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827649, "uuid": "99ffa672-7d80-4915-9f70-f851deb6db75", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827649, "uuid": "e6413d57-637c-457f-b71e-c759ede3fc95", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827649, "uuid": "3267996c-acbc-4e86-8dad-776930582704", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a89d87-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773827105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827105, "uuid": "37994843-71b2-4185-8ca9-0e343896f0fe", "comment": "Malware payload (RemcosRAT)", "value": "0b5411368774058ba514baf1f49d38c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827105, "uuid": "a1802cc5-2d5d-4bd5-bf4e-f6eced43c6c7", "comment": "Malware payload (RemcosRAT)", "value": "888758c6b4596257f64c296b12d3a10218066bf3221f8015d669a00d2d2db056", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827105, "uuid": "26d1b6ce-5d98-4198-b572-936f30621aba", "comment": "Malware payload (RemcosRAT)", "value": "bd96e311d5e88f59eb8881008b9d97cd2d0bb623", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827105, "uuid": "0251b02f-dcf2-419a-aaea-4bcbc899b640", "comment": "Malware payload (RemcosRAT)", "value": "3f96de68b22e4f6daa36aca3936460d20eab42b635ec8beb7de2e16b8be6ebbb6720e1e3c88d44473414c1174a289408", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827105, "uuid": "5b02fb08-fd02-4f89-a399-d15d02a56d3e", "value": "T11E858B927DB299E871425A63B934434FBBB40E4F10595F24F6A30C853AE844DE1AEFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827105, "uuid": "b75c09b1-5bb6-4616-90b5-d0e12a9b5cc1", "value": "768:Jqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqe:g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827105, "uuid": "b05f4f79-17d4-4a46-89dd-022dc20641ef", "value": 1863262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827105, "uuid": "5f5afe2c-fd3a-4689-abe4-4e5f50df8fc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827105, "uuid": "94a22dff-2e94-4e60-9a32-affd96587026", "value": "0b5411368774058ba514baf1f49d38c1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceae70f0-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826531, "uuid": "9612c520-f660-45ca-a788-fff6fe54ba56", "comment": "Malware payload", "value": "cca54cc00d365d5a499a92d53e2043d9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826531, "uuid": "5008f145-c5bb-4a89-8cbf-7fce25213100", "comment": "Malware payload", "value": "8afb0d651eb2917fc8bd574a38235fd70be07985b77cefa8181f35c238546e4a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826531, "uuid": "49bfe1d9-d072-4279-8a2e-d04883f118c9", "comment": "Malware payload", "value": "e9701f3046422396e9e5ea9dacf4a568077520b1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826531, "uuid": "c588d455-1932-4b36-b7fd-aaf50f77837f", "comment": "Malware payload", "value": "fe473dfb77cb1660bce936039578fa42110c05d7338a9a5adee671b745128a263bcbf040662c0a725f4986cbd9e65ebc", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826531, "uuid": "1f2a7b01-3c00-4322-b744-7943fef3fe6b", "value": "T149052311F8A2BFD4D543B8FCDCC464E6954CFC100E9BE12BB2B83739A935225D1B469A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826531, "uuid": "c21a0bec-d835-4703-a7fa-552ae3b3fce4", "value": "12288:HrUUPk/oT7BINzw/nTOsGWtVHz3Us3lvRpFSqTmC9F0KZMscU/k6T/:fP8oT6JwfTHVI4l5pk4H9FescU/km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826531, "uuid": "3d44b202-b1c1-4428-9134-ccbfe6435b54", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826531, "uuid": "08fbfe19-63cb-4915-81ee-0b17a581e0d8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826531, "uuid": "ba582b7b-07ca-47de-9129-0d1b565cb2f5", "value": "DHL Receipt_AWB811070484171.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1ceb65-22d7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773844462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844462, "uuid": "9c6f7462-d957-47ea-b1fb-739d2819cb61", "comment": "Malware payload (RemcosRAT)", "value": "599c770bc6e1fb33d626891262d04fd6", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844462, "uuid": "dba1011b-f191-4a9b-bf8c-be1019b2c335", "comment": "Malware payload (RemcosRAT)", "value": "8df44e3d818fcb9bea9235e028409285e24c9f06a7ead678be1aeb82475535f8", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844462, "uuid": "a01a3488-fba3-418b-9a85-f46f6bd16513", "comment": "Malware payload (RemcosRAT)", "value": "1854379fc2502b842c05c7cf4575db96ea8afac8", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844462, "uuid": "de6afc6e-218d-4631-a0a0-cf0f7bc713ec", "comment": "Malware payload (RemcosRAT)", "value": "1cbeec0327e8d56b1ca6dc8a45ce1db7c288c87453c086f2187819f5317806051a04a8851e5b2367b0e2e9167dfc3eb1", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844462, "uuid": "31a6e9cf-da73-422a-aed2-c24d0e72dca3", "value": "T1F5E5CFD06F6526970AC421171DD782F9D9BAD31C4BF05A10638E2FF0339DAAE65C2AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844462, "uuid": "f8e90e07-9df2-402f-b8d9-63484837a288", "value": "192:GWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW5:B+Kt1vfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844462, "uuid": "6f4e09a6-443b-4ac3-8b49-4e009b266dc6", "value": 3052686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844462, "uuid": "3c9461d2-a1bc-468c-821a-a77a9e53f1e9", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844462, "uuid": "98c2ee71-9065-4929-9f30-73fff51c5374", "value": "goodthingsbestforme.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f73a9f5-228e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773812950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812950, "uuid": "ca9b5665-c25c-4f4d-8148-519467a2729b", "comment": "Malware payload (AsyncRAT)", "value": "668d7233fe42f5f36526ce8b4275186c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812950, "uuid": "2838aa6f-f2b4-4ac5-85f6-0618b8125da6", "comment": "Malware payload (AsyncRAT)", "value": "8e38dbbf489e49b833117da15856f300d364274a96ec4145a7959627486d3f83", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812950, "uuid": "26f8d99b-eeb5-4c19-bcef-5e477665378b", "comment": "Malware payload (AsyncRAT)", "value": "a463300a860f499ca4d8e9ac47ab7e03c50ae0c4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812950, "uuid": "e5f3f88d-66b2-4776-a5c7-a22ce4cda3b6", "comment": "Malware payload (AsyncRAT)", "value": "097ef4910fa3e08623f8ceb1025cd15bde629312023393e6f79c9e274467a012794aefad25ad0a3333f3d385a1725a5f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812950, "uuid": "e5e65317-21fa-4aa7-9fdf-96cca977c819", "value": "T134F22A04B3E84A65E1FE1BBD9D3192008375F9479E23DB9E1DC0509E1A73B888F64FA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812950, "uuid": "fbcc7bdf-8051-470c-b70d-cbadabe1fe5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812950, "uuid": "dafb8e93-9275-40ae-b353-62b21aa3fdd5", "value": "384:CpgcRiDC95rXxi6pOuArdM8QwM0/dB5eiNDTRCOV3buUsjQxnCQMJyVEEOjJfKny:G5rBih2wM0/XnNtLJbHBwySpKmHNMp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773812950, "uuid": "c5fa5dc5-aaa4-458e-92f9-9bd6bab4bca7", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773812950, "uuid": "d6890e92-3435-4ff0-94d1-51139b3e84c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812950, "uuid": "93c246ec-497a-4cb5-8594-92aaf104e84e", "value": "RAT.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc039c41-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773828325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828325, "uuid": "b5b566d3-fb07-4c53-aea0-cfa673c1842d", "comment": "Malware payload", "value": "2de2d03727ef0c411b57c22d0bfe03d6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828325, "uuid": "b78fb20c-60d3-4feb-9d43-4d475771f368", "comment": "Malware payload", "value": "8e6a3d45c2c1010291b1c8140d3ca667d6b26f3a34a78adf3c50830cefd1e8cd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828325, "uuid": "39f08b46-07f6-4b21-b327-677ff8bf6ab6", "comment": "Malware payload", "value": "dbaeeeb9c8923ea0778852e8d1be9ee049a9d4a3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828325, "uuid": "c9068c5b-8539-455a-9078-1907235681cc", "comment": "Malware payload", "value": "75195bcee7b025c659b3d1cd3e05acc5d06bc2f714dae7ee07f05490b4bcbaa34a4faf5146cef9a0cb712d0b4c37ab33", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828325, "uuid": "68921d6f-041a-421c-8c8b-5eb4e538bb08", "value": "T13D55B6F12E37963DD95F6ACAF851AB61F34954A93122630C1C0EBDDE5B226C8AF31710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828325, "uuid": "050b39ee-39af-4d4c-8190-a8486cf52cd2", "value": "96:nuu6R77ui3AW3R+uuuP7P6u+F+9i1iDJElRu6y7CPkvDeJkX4QxibH55oQAazoEg:gMmFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828325, "uuid": "83a4d0b9-5d57-416e-8a9e-35afd9896237", "value": 1294243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828325, "uuid": "ba03d48c-c826-4ff7-b111-4364a6898e8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828325, "uuid": "4e60cf31-9ff6-4457-a25d-bf712bf09d9d", "value": "2de2d03727ef0c411b57c22d0bfe03d6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aadbdf4-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851623, "uuid": "a2e237e9-408d-4d0b-ba70-11c72533a916", "comment": "Malware payload", "value": "1b922c345ba52ef450b59abb51fbf051", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851623, "uuid": "f160c47d-a096-4153-b9d9-282a00e56b24", "comment": "Malware payload", "value": "8e7045090f9b4c319696dd092a340fd88c5c48680b0b69101998b4a15e51d92c", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851623, "uuid": "38f30739-6d4e-442c-801c-a28cd5ea3c98", "comment": "Malware payload", "value": "bb7f087f6a29df4eaf54eb311d94936bc5e5d825", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851623, "uuid": "98f72a3d-d01f-4c76-b7a9-83b854ebdb73", "comment": "Malware payload", "value": "f61ff7247654c259b683dab3a01a71b34c0da2cbf493811523babac29f2eab552b5ff55f089dc96d4db05f504565e918", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851623, "uuid": "b7f7cee9-6f77-4b51-b977-f02f02cb243f", "value": "T19DD6EA9ECC194454DC78B168D87131F66059D9A6B24343DF3D8CE8A3942C17ABCFBA8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851623, "uuid": "e315e6ba-5499-4b07-8695-147bde05a0e4", "value": "192:Ew5bGR9Ri2HtA5BfZ1fjpQZhQaNY6kQDqYbGm/vHqke1tmiO7WMm8cJaJkh2f43q:EwVGRDik+zfnbyQmtTDlbGVG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851623, "uuid": "49394f10-a707-440e-b525-9bab196e596f", "value": 12727632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851623, "uuid": "5e575f5b-d487-430e-bf4c-b927ad62b9af", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851623, "uuid": "2c084f14-a73c-4481-b453-1159dea4aeec", "value": "2SLazPhMAR17_hvvvvv.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc78a73-22e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773849994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849994, "uuid": "202dad56-95da-4a1b-92d2-7e3dab56d4ef", "comment": "Malware payload", "value": "8961f092926b3980a2092c6239d7604f", "object_relation": "md5", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849994, "uuid": "70912b1c-7323-4617-922e-6823597f88b8", "comment": "Malware payload", "value": "8f2cedfae722350505db1e134f08861d703fc8ee3780641233ed615559078e2c", "object_relation": "sha256", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849994, "uuid": "c6adce85-09cf-40ad-9d6d-e4684a5d93e2", "comment": "Malware payload", "value": "9cad84012f983b6d9a0cd7e463d0d93db0fb64f5", "object_relation": "sha1", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849994, "uuid": "6c4baa16-0458-43c6-9526-18fe642672c5", "comment": "Malware payload", "value": "bfc4c00e2bc8329d95e4eb6d0cea2fc5e0738380d6f063e4f5a4dd3987730c057195ac72f9672139ccb46f8d7274334e", "object_relation": "sha3-384", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849994, "uuid": "edbc5719-0db9-4337-ae1e-c594e7dc03e0", "value": "T1B0A1B616B775E57541A30615DC8B3E801E2E41FB600778187ACC81C8BF2666EC7B93C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849994, "uuid": "01792ca2-2007-4a55-80b6-7cbb4bd48628", "value": "96:z7u9MLfZxi/U8r06yZSREYGDed8oASspf7BR7ebL1rKd99l:mSM06yiB3ASIt5+rKd/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773849994, "uuid": "e9ad83e2-99e1-4803-abd2-d9710d8830b4", "value": 4918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773849994, "uuid": "28f20abf-13e8-498d-81dc-8b77a18b31d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849994, "uuid": "06f050cc-67a4-4bed-8d45-a2438497fc2c", "value": "verification.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1c6016-22a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773824061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824061, "uuid": "5776093f-eb65-4473-b9ff-f9868e111f47", "comment": "Malware payload (Gafgyt)", "value": "9b976abe19bf765074172d896c210e53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824061, "uuid": "484da42d-dcfc-4ab6-bf79-fd8f5841271f", "comment": "Malware payload (Gafgyt)", "value": "8f79486ecaea3f2df3dbfbdce3024fd24dd55bdf4c71e679610fb42725a34efa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824061, "uuid": "2c9df3ed-453b-4dce-b160-0046ffdc5264", "comment": "Malware payload (Gafgyt)", "value": "2bd4c3b6f108d960eb10d1c8e9dcdfc9c8d7f826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824061, "uuid": "99fe23bf-0adf-4ff5-9aad-04346a444b6e", "comment": "Malware payload (Gafgyt)", "value": "0266625cd390bf93d3cb514452723d894e942788c613b72501677258e1e7b2f6c28241d51c141c129c15ecc556c9de8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824061, "uuid": "12dbebfd-911e-4087-9f53-8afaf4b65315", "value": "T1F8343807A89480B9C4D6C2788FEEA626DA75F84CA134B11F27D56F263E5CF20AF1D705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824061, "uuid": "c1b8abd4-b075-41cd-8c3a-f38eb7a668fa", "value": "3072:ZaL6196rdo2RT5ZN+4kpv+woq18hu6axXlBh+D6m7DkRGVLKf208eeA0eSfCF:C61uC65ZN+4kpv8up6wR7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824061, "uuid": "c9452429-05d9-4f6b-93ee-b58de8116ef1", "value": 235592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824061, "uuid": "a34f0abc-02c2-4395-b38c-72e951e4fbe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824061, "uuid": "04bd7b36-ec8a-455b-bafd-044b1df77756", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20db1e1-2315-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773871151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871151, "uuid": "f6178df1-f3e6-4b43-9ff7-4e38742d24c5", "comment": "Malware payload (LummaStealer)", "value": "bc17ba69397a89332aa0ee874deecb73", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871151, "uuid": "99ae0e8a-9b50-4dd5-a20c-0b4a87598c30", "comment": "Malware payload (LummaStealer)", "value": "9169004f2193896e154f51f9c3e018ff0aca2cf8d362b793dab4e967fda6147c", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871151, "uuid": "3610dd3d-d631-4264-b5ae-00d936d94739", "comment": "Malware payload (LummaStealer)", "value": "182561ee583b85d3ed8864f9ba2098a561bc9e04", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871151, "uuid": "c3b962ab-ec8d-4ca1-94dd-de7a9cd5ef25", "comment": "Malware payload (LummaStealer)", "value": "e24a05bcf792d63ff34ce3b0b8d438f677473cb8d8bcdae6c84e18c5127b156126fd33b7c1371628ac35d008583a2c09", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-GOLoader", "colour": "#EF34D1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871151, "uuid": "f9db19fc-5aac-4810-86db-eebd6ca7d097", "value": "T1BDA5CFC6225911E6FEF09D323757418308226C3A66D4AFAAD78CCB7D44D8745E326A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871151, "uuid": "8bd7553e-ffd5-4cd2-a627-bc85d6bef835", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871151, "uuid": "53038044-983f-432a-84b5-5be92fbff7d8", "value": "49152:uJLmyP/Xi+og49gdaLkMkOOg41AuyRgMahJlgwUEx:Jm9ogGgdTPOOg47yeMqJewUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773871151, "uuid": "111c7ecc-ccc9-411d-b63f-227f1c023f12", "value": 2143744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773871151, "uuid": "aefdf94e-7fe2-4183-b3de-f1b0cba4695e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871151, "uuid": "190c77f6-aa22-4f8a-84b3-f40f5a9edff8", "value": "nRvroBJ7jhFEIbfLN8XwFppn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4526b65-22a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773823051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823051, "uuid": "322e8281-dfb2-43d4-8b57-35b57cf663e9", "comment": "Malware payload", "value": "27fae4c0715132825f81cebee8a1f4a5", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823051, "uuid": "2fd7279d-0a20-446c-88b8-06c8b61ea378", "comment": "Malware payload", "value": "9310630802365c70f17d8f2ad76dbbe57b4aa3604362c09280a21c01d8ca50b5", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823051, "uuid": "7c602ddf-71c5-4038-90a7-aabf53f21fc7", "comment": "Malware payload", "value": "cf4fb1abdd206c8a8c7657c6ffcfa2c4ec53cd21", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823051, "uuid": "213efee7-f837-46d5-8404-6f0412874ce1", "comment": "Malware payload", "value": "b94c94edd9bcc28f43d660a2da533e65cf99b8ebe412d74a5ac87e0a13d5928ff85a77c7810ba775c357598b8ba30bab", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823051, "uuid": "64ca839c-76cd-4d00-accb-eea380d78600", "value": "T134B3109B0EBD84EC9B4F205D011F5C5BD98FA217065DC4903BDEAD987F32DA9B1A89C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823051, "uuid": "06c63a44-ae8f-4068-beb3-7845387d5fef", "value": "768:Q1kJsULoMXAGgQNkwHvj+kI3rpZETOriHE8VUQDU/68f0+r4NkcDAc08U53F2PIj:ef8WfRr4ucX+F2WcxXw0sS+LagZ1C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823051, "uuid": "7bd88ec2-919d-4276-ae63-bca6d9c3a788", "value": 118117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823051, "uuid": "42fa2e8f-b0bd-4ce2-bfc8-2f2be808f51f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823051, "uuid": "e6d46dde-f501-4ade-b44f-85d0226a9846", "value": "Production_X_Summary_691.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0e94d3-22da-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773845777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845777, "uuid": "d353c8d2-d454-4f08-9f36-7282d193c814", "comment": "Malware payload (ValleyRAT)", "value": "26eb9c5f255ede0d16eebea3e04e9e88", "object_relation": "md5", "Tag": [ { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845777, "uuid": "998455b8-9e40-4c12-8219-7ba82bc631ef", "comment": "Malware payload (ValleyRAT)", "value": "94cad288a51b1aec90e69238e04c076d70139945cb2b5c44c437642b83318638", "object_relation": "sha256", "Tag": [ { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845777, "uuid": "102a3733-0db4-4c22-bd15-abc2f2217092", "comment": "Malware payload (ValleyRAT)", "value": "b447507fe4c9114e173a96eabb27b09d622c64ef", "object_relation": "sha1", "Tag": [ { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845777, "uuid": "afb24225-fdce-4de2-bf0a-8a5997cf90ac", "comment": "Malware payload (ValleyRAT)", "value": "74c910412182a1e839396c3ebac912ee30f26fe535afd5c0a57883a0f64dd16719e6bf33bd3baf910087072d733f9591", "object_relation": "sha3-384", "Tag": [ { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "Vigorf", "colour": "#1A2C84", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845777, "uuid": "6cf46319-f2fe-4d51-a36f-0c51f15b10cb", "value": "T192E533598531C998D0285BF970ECCA235A8F56F8D41BF1A946DA5CB2300E89B357FFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845777, "uuid": "afcace9e-1794-4da7-a122-2cdd02cbcded", "value": "98304:/ASWWYYsefrg4qSyqRRgmwT7laI+lFzCzC3JNTgxNgK:YhWbst4/r/gd7wke3PTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773845777, "uuid": "ef1918dd-ab4a-4458-b488-0b8dfe09ca1d", "value": 3313036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773845777, "uuid": "4ffbcff7-121c-476f-a5d4-da7b55cfc13e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845777, "uuid": "5124ca41-a0af-4302-ba69-600d729e1326", "value": "SystemMaintenance.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6184a69f-2314-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1773870586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870586, "uuid": "72786723-33f4-41b2-a214-f555fe8c5bb6", "comment": "Malware payload (LummaStealer)", "value": "31eda7ea837bc4c5589638e8b8c51595", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870586, "uuid": "cca67be1-472c-4b35-b5dd-5524850ab848", "comment": "Malware payload (LummaStealer)", "value": "95042d369e0edccb5d22cfd2509bcdf6934f7b9bfd213fa9c3e8631beb8d35ee", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870586, "uuid": "91a16ddf-7932-4f91-a9cf-48cd564e3f4b", "comment": "Malware payload (LummaStealer)", "value": "7fa5edd30439bfa411f9893a39ec5638b048a444", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870586, "uuid": "2ef0dc35-b548-4021-a13c-b4933eb1b79f", "comment": "Malware payload (LummaStealer)", "value": "7ab1a0568460c38ea198071f547803733593128569abd2781e8b8c791ea2d914e27b8fea92c88efc2d97c1849d029464", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870586, "uuid": "f3bf8673-6469-42b5-8ba1-addb18178dbe", "value": "T16EA6DF02B7E880A6D0BB9238896B9756E635BC11073096CF2254BE6F7F737D05A39713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870586, "uuid": "f2e759f9-5044-4278-bf6a-ca137c9eb633", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870586, "uuid": "de2f4011-84d6-4103-ad77-108ca41e4aff", "value": "98304:YAq5YrgHrT8DLpSERF2iFt0MqQVZnKqSaLg4ls281q:25YrgLT8Dldj2ivr/nK6Lgus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870586, "uuid": "e8d91ca7-ffd8-41ce-ad3d-f76df7d90d71", "value": 9553920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870586, "uuid": "ab61e9fc-9e67-4e2a-9a63-2e53c050f776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870586, "uuid": "d2f4e0e5-a0fd-45d4-a1f9-1c0f70191bc1", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega]_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4017ab2-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806837, "uuid": "b0308486-4517-4c0e-b87e-4c0d24e36fb8", "comment": "Malware payload (Mirai)", "value": "a35a8bd7ce2c6d772f02332f26381ba4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806837, "uuid": "99050ac9-4fe0-46d9-825a-7def16764669", "comment": "Malware payload (Mirai)", "value": "95bcc0a2bb0fff25a2770010406cd0964fd4b3033ed8bae181518f7c8b69d324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806837, "uuid": "e0b9dbf2-e7b6-4379-9ece-7cfdbd2add99", "comment": "Malware payload (Mirai)", "value": "29f98e67662a84e2ea122f0ac4782aefe8e3c0ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806837, "uuid": "69b44389-dc15-4c0b-8181-913757aaa7b9", "comment": "Malware payload (Mirai)", "value": "bf8ad7569798db364dbefc360a0964727d24f4d6c92f7b10e0fd9e39beeafc1effc1c32adfd565539d9069d280d2e69e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806837, "uuid": "ac72a415-77df-44f4-904c-3e9d041539f3", "value": "T1DC043A07B5C184FEC499C07887DFE536D931B85D6238F25B2BC4EF222E19E606A2DE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806837, "uuid": "2a2d9d5e-cf09-4f1b-96f6-b58c9ba7ad15", "value": "3072:o6fBJZVVzg58MZbaTkuxoR0+4QohZzS0qMiQgWlDXTfRRHJAgaKmFnWYl56Y:o6JJZVVzg58MZbaTBxoR04oNPpAThBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806837, "uuid": "1efff2e5-3ae3-4c9e-9a7c-3d9072a7099c", "value": 185272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806837, "uuid": "46397c32-18a8-4bbb-ad62-743a91c1d389", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806837, "uuid": "88857423-efe4-4653-b0c3-fd368396ed2c", "value": "nuclear.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a21fe5-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773825311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825311, "uuid": "4012f674-5d0a-45d4-aeaa-7353e8c2cae7", "comment": "Malware payload (Vidar)", "value": "428294d6a90965ed10c7600055fbfaa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825311, "uuid": "8fb531be-9cde-4fa9-b4fa-8023e6b9966f", "comment": "Malware payload (Vidar)", "value": "95c469772c9b6b5b96bf12af5806fbe7ba60f36761c4d3bf844b19a9f8e60111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825311, "uuid": "b419f3ad-f69a-405d-8a90-b366e3a9b7d3", "comment": "Malware payload (Vidar)", "value": "4640b742dd42dfa9128693bcc1d23f3946ce220d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825311, "uuid": "a7c72c37-bb94-47bf-b318-b0e97dc4ca56", "comment": "Malware payload (Vidar)", "value": "7a38a59483a65619a3cfa1a959dfefae75a99d13339d6346464ed4ad79eb5ff87ce217ae8c7b6f5bb93481e69c87f343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825311, "uuid": "1919e9de-efa4-4a00-b2c1-c4f6531bcb11", "value": "T134A57B0ABC9418E6C06E973689B762927B71FC590B3223C31E90767D2F73AE0AD75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825311, "uuid": "af9eae75-0b36-44cb-81d3-17ae3cecc54f", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825311, "uuid": "8af638dd-38bf-420e-8c63-a38cb42c9f3b", "value": "49152:6lnn/uy3i3pj1FjVQq7L0oG8xpNTAL8T31:6l/ZII2LvxpP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825311, "uuid": "27f3c85f-bb17-43c6-9477-516c981c61d5", "value": 2265600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825311, "uuid": "6f9608a2-0b15-4534-83cc-08ac841529ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825311, "uuid": "f177b469-bdc1-450e-beb4-360db3d327b5", "value": "428294d6a90965ed10c7600055fbfaa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d6341e-22a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773821688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773821688, "uuid": "bc4333ac-567a-414a-a83e-669edd292b48", "comment": "Malware payload", "value": "cd686324a88015c338cbf56150223f4f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773821688, "uuid": "bd618b8f-ec0d-4a98-b33c-a915170347df", "comment": "Malware payload", "value": "9645fbf7029a23dff42283924cb3cd63a750bb734e2ab31b13d1b459c014e1cf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773821688, "uuid": "8ee44ef2-31be-4564-aca4-07fdf63b3c2a", "comment": "Malware payload", "value": "7c63ff20b33443c5cf83f4c98ef0c923a2fad838", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773821688, "uuid": "bf471a5e-86d0-4cf1-83fc-5234ee6aaba2", "comment": "Malware payload", "value": "817d9e2bd9a669c1aa9714f14785208884cff9cfeb4fb6af07ed7ee7a7b5bff6015b82ef0debdbf6f85d16aa82966374", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773821688, "uuid": "8ddd75b0-3534-4628-9d3d-48bb69c0a72d", "value": "T12B6733E3D8D30676E52FA63F4BA4A4045D82FC618B430E2AAD3D376258F36D235F6149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773821688, "uuid": "3411f0fa-9647-4980-bbb7-a0c0fb8e57f1", "value": "786432:53vPQ8mJM/paWkD5yljUIYaOJBR+y6ytsr5Y9X+5rU:53vpmJM/paWo0FUhBROJrM2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773821688, "uuid": "3a3a53eb-e81d-4563-a5fd-7fd44d123b59", "value": 29888512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773821688, "uuid": "3feb7f06-18e1-467a-be96-9bd48d0ab92c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773821688, "uuid": "ea8f6d91-6189-4d22-9cf6-d19674b041ff", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a1132d-229f-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773820396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820396, "uuid": "1daad405-6917-46f3-8f2c-24d1ca14c7a7", "comment": "Malware payload (CountLoader)", "value": "1b430474767c89e5f2d5b631dabe23c6", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820396, "uuid": "3d6344ac-a7af-4304-ac9b-04475ff7265e", "comment": "Malware payload (CountLoader)", "value": "964676e342c14571397111d8916f3fc8e810c9fa0234c5e27b9dfa02f43aeb8b", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820396, "uuid": "5b4d75c2-44bf-4275-ab03-f78d6eff40fd", "comment": "Malware payload (CountLoader)", "value": "2f011784998f238b79e93b5406d7504de827f4f9", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773820396, "uuid": "2da1dc09-21d3-474c-8874-f486057b680e", "comment": "Malware payload (CountLoader)", "value": "530e383e987b4b3ee23df96037e866a0f103a2f32587a387d20ecf5c816449c96c5ccf3ad66116c8489fa7d0b474868f", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820396, "uuid": "db78734a-3761-45b4-953e-97ba561d8157", "value": "T187B3318A5F4EC1EAC65F6838569F9E039789C2C3170D84857B1FFC407F32DA9606A6E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820396, "uuid": "40a89901-c5a0-47f7-83c5-634a7cd88631", "value": "1536:CRj2p91p7jommfMEG+pJ6B1hKp96GpsQDx:CV2p91xEJA1hKp96GpsQDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773820396, "uuid": "d6b3ac06-d45e-4a04-a229-0df803c77d34", "value": 111945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773820396, "uuid": "e3702e2e-b84c-470b-a947-64d529c84a26", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773820396, "uuid": "8e233297-84f7-4513-8af4-f24951d171e1", "value": "Record_Main_v6.3.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5df1fa-22a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773824299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824299, "uuid": "732dfaf6-8ea4-4a4b-9bf0-631eb558c3da", "comment": "Malware payload (Vidar)", "value": "b030eb0a4a8406be382f38be561e5bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824299, "uuid": "292cd0b9-38cc-4838-9893-b598a99c4fbd", "comment": "Malware payload (Vidar)", "value": "9679180871a657be81ecd13972f4d095052cea6afa3006da88a38837817fb2a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824299, "uuid": "f536276c-8d4b-49f0-b765-b52c00fed0aa", "comment": "Malware payload (Vidar)", "value": "44a148846d93f3e911c5f56ef88b4084076f3bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824299, "uuid": "4efd971f-4e21-425c-944d-fa3480deace3", "comment": "Malware payload (Vidar)", "value": "7f1a4298c0d0c943f68690b34125bc95e3a6f37f0f06f8412d1ff0d592058caccbd95a4f5f9cc0ef6e842aeeafde34f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824299, "uuid": "a191a8e0-1ea2-4800-93a3-26acccd6aa4a", "value": "T111A57C0BBCD040BAC06AD33689B652A27A75F8090B3233D72F51A7783FB67D06A75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824299, "uuid": "74c28ae3-c4e5-4f74-9df0-bbb69f02b0fa", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824299, "uuid": "37a0b920-d917-40c6-94db-94652fe15188", "value": "24576:9fo9WV8mX32KjSMpitCSQJjkOkBQ0abuwnKDIs1Lsczwh5t9pV4esOGiW2b0a:9fyC8bKjSMpiwSQJjkOLrQc4r8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824299, "uuid": "90662544-9b66-49f5-96b5-6d5fce2e422c", "value": 2182144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824299, "uuid": "49d5d960-a33b-4d7d-ae33-ef1df1fd742d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824299, "uuid": "cb3118bf-8cdf-47c8-9983-ad41d5f370e2", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94ad006-22a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773823167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823167, "uuid": "fc97759e-154c-4369-a7a1-91a2bbe50296", "comment": "Malware payload (Mirai)", "value": "c5bff60ac10eb67b0e83c0d8391c9da9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823167, "uuid": "c167e0e9-f709-4016-a1a4-65bf49424052", "comment": "Malware payload (Mirai)", "value": "96acd74ad9b038ec567ca571b7e235b6a7c9a533fbdbf66c0e16179eb61e6e1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823167, "uuid": "cd0333fd-fc6a-49cc-a54a-73151698ca03", "comment": "Malware payload (Mirai)", "value": "5ac6b8a4456a3fb9e400bd3d60d36017c3b8afdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823167, "uuid": "b718f1e9-5aed-4957-920d-f0c07d1d0cfd", "comment": "Malware payload (Mirai)", "value": "4e70c02d7a4480aebb34829b89af0775c014fca787d5247cbd549bbe2489ee5b667498ef10bef47d966ed4401b573ab6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823167, "uuid": "20c3661d-e767-4d65-bbfa-ef98aace4e15", "value": "T17174D45B6E328F2EF279CA3187F74925E35933D612E1C685D5ACE9101E2024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823167, "uuid": "daed4435-f083-4539-aaa0-3e6b4d88a20f", "value": "6144:umvve9F/uyTPm/O7hedPslSbIb57Peha6MxB+CoTopTB:uql7Q7PhfRTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823167, "uuid": "4f5536d7-a65e-4a91-9565-1a284a7f44ec", "value": 356224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823167, "uuid": "6c137401-4475-4072-a6eb-1f50904949df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823167, "uuid": "267d9093-846f-4e08-ac25-797174a9969b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4243b03-22c8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773838137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838137, "uuid": "f7652ffe-c4f3-42f1-bc9f-9b11aacf1716", "comment": "Malware payload (ConnectWise)", "value": "8800401e840e43d68c3943dfd6f8ce55", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838137, "uuid": "bc1e1bf7-e247-41be-ae65-3c1d62a9544d", "comment": "Malware payload (ConnectWise)", "value": "9720400436419b66563adff2d10478390ef4ae6a64c2d6f9e928c87e24ea5c04", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838137, "uuid": "66e1c925-65e9-44ac-b7df-854df74ef605", "comment": "Malware payload (ConnectWise)", "value": "a3a63161f0c63d2889a3b7eea9ebc9c0a9eda5a6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838137, "uuid": "284d2a5a-5d2a-4e94-b44b-5fc71265b193", "comment": "Malware payload (ConnectWise)", "value": "4fa0aaf06116d534c459be292214916b19e5f5c00dce2e43d286ce7158bc183989d1cc5f60b7488033b819f5bc9dff7b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838137, "uuid": "772bfe90-3884-41fc-b4f5-9aeb5480b576", "value": "T193465B57EC9115E6C0EEE1318922A252BF717C482B3523D32BA0F7796F76BD06AB4740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838137, "uuid": "36f7259e-63c4-48ad-8e68-7c4f5d76a225", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838137, "uuid": "de4c72f7-6896-4998-986c-5741faf3c94c", "value": "49152:XTXRqwZRQ+sGO8rRmJeoYIBnaLbBNEKCfBHN2MULhKn7j+cWTmIWu06wKeK9KYRB:XRRxF2vAKKSNR7KcI/fx8EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773838137, "uuid": "bf260bdf-2f05-4711-aa0f-79d0314152fe", "value": 5829632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773838137, "uuid": "62208f9d-3a3a-4ef8-a7a5-db0e7ade83c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838137, "uuid": "164f739c-2c2a-4ff4-9c00-cb79bd7bfd68", "value": "SSA_Viewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4204cb-2266-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773796063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796063, "uuid": "cfe8f309-85a4-4a04-a246-b064b6614030", "comment": "Malware payload (ValleyRAT)", "value": "e75adb54fa5db1a23ae93199b66f479b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796063, "uuid": "c8cb7a5b-d183-4127-8cfb-ab04bc0407e6", "comment": "Malware payload (ValleyRAT)", "value": "98935ff013e3d8d9e9a259a188643937c18833b226953c9b7929eab8e02f00a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796063, "uuid": "dba5d8de-d50b-4f3f-873f-4b54b1662cce", "comment": "Malware payload (ValleyRAT)", "value": "0f549c07acfc384fc63a40bcfafd016d4a2b310b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796063, "uuid": "8e147d70-ec6f-4058-b92f-30b4a7f13dd3", "comment": "Malware payload (ValleyRAT)", "value": "5d4c039504ce0ba00055472044248b70cf3cba3be80f8b76cdd65af5493966c58a4d29c83b68a21a0fbd3870f8eac0b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796063, "uuid": "91cb0fb2-d9a5-4813-999e-cb6db1af3ad0", "value": "T1D144BE47B3B630F9D5B7D136C4621615E7B2B87517609BEF03A04A0B1F23AE09D3AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796063, "uuid": "d257657f-1511-485e-836b-cec6d283b873", "value": "98542742d40ec559c0b2be1029d43198", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796063, "uuid": "ab6531c3-fc0f-4f58-922d-656baa8718db", "value": "6144:F1nV26QfAg9qHs9d0gZkfuzKkZ8zNXk4qVGVV:F1nVhY9qHMdvsL1B+Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773796063, "uuid": "82b4b7d9-bf79-41bb-b248-ca2e97b5a014", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773796063, "uuid": "36007b75-badf-412e-964e-276cabe6c821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796063, "uuid": "82050662-11c3-4b63-b066-59a47ff80568", "value": "ProcessExplorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce6f4a1-22a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773824596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824596, "uuid": "d0741180-9fc4-4f53-960c-3db30aa6658e", "comment": "Malware payload", "value": "fd28c00a4ed55a778d7928ab34371378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824596, "uuid": "876e09a4-4bb7-4b23-b4ef-56881c198f12", "comment": "Malware payload", "value": "9a542f285bf6a25b57166a4f3a9c0b8c3415add05bd5a34f6a90eca374564633", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824596, "uuid": "d7c40c73-e1e5-4cb4-ac0f-32210bbee78a", "comment": "Malware payload", "value": "12d8a0df93ec7895090765bf5b34239b6b7ec752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824596, "uuid": "95135815-a12e-46f4-950f-c3ea9355a28e", "comment": "Malware payload", "value": "19e4312aa1b826e9468676f90029373694deabf1646f9c86f8260ed7901d78c587ec0258f9547cf57d6c14c5e52612a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824596, "uuid": "d36992bf-f994-4997-8df8-5c0adc50feb2", "value": "T178552315A6AACE13D8AB07B11032C77493B15E0EF962E3468DDDACFF791170EB121663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824596, "uuid": "e5190d87-62c9-4ba6-bf64-c0a26315928a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824596, "uuid": "b74ad578-a4e2-48a4-bc31-817bd0d4abe5", "value": "24576:Pa0Z+GsXxQPZrn4lr0Wzq9BVx6i6czQC31MjsulQjdRe2Brl0N+2XpQ5TYO8hbK:tjsX0ZU2p9zx6Nev3y92QJ8Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824596, "uuid": "6e455734-45ad-47f1-8e75-752e0c780bb9", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824596, "uuid": "089be7b9-6a5c-41ed-b065-c3858a0d54a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824596, "uuid": "401cd6c7-0c8c-4df0-8f9d-2e269b99fbdc", "value": "fd28c00a4ed55a778d7928ab34371378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e33ec4-2319-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1773872952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872952, "uuid": "e0365199-60ad-4517-b29b-d35e5c1a7bea", "comment": "Malware payload (DarkTortilla)", "value": "843f54fab62f8dffb18b61842e8f10a2", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872952, "uuid": "87315c91-edc3-4823-94e6-14e500c2338a", "comment": "Malware payload (DarkTortilla)", "value": "9b4bda03a4885230b39a788cbd733412c498ec36393581b2bf5b060844d8b1f4", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872952, "uuid": "f4c7c694-0e67-4b71-b7f9-bf1bf22fcf6d", "comment": "Malware payload (DarkTortilla)", "value": "02b4c26e3907c1c4c019c56a16123290624b3284", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773872952, "uuid": "70b6e3e6-8317-4946-925f-e3042182c538", "comment": "Malware payload (DarkTortilla)", "value": "01115590f15e3dd6e398cd4aad3c6957bd4c0eadfb6e6ae4bd5381a10db68c017074ec82080765a936ea163c230a8d5c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872952, "uuid": "90215c5e-91d5-4c35-8398-80d4b17c54b0", "value": "T1C185F11927EC6A98F4BFAB7894B5841187F5FD07EA31DB9E7A84509F0C32B408A51733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872952, "uuid": "29a1cb94-144c-44f6-abeb-5cc69acb7568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872952, "uuid": "a6037718-1e42-452b-94d9-73f69899def7", "value": "24576:Rz6iRRI2E0KR7KLLDPQ25R0/eS9BrVXqI+4R74rEaD:0iR3KR7KfDP3S/pVaIl54d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773872952, "uuid": "f5694541-599f-4f5b-a212-56ae4b1b3276", "value": 1773568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773872952, "uuid": "c6b634df-6538-41d2-bd78-486de1121ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773872952, "uuid": "b0f7c724-f852-4f93-825d-20d847e03504", "value": "Purchase Order..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3551631-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773826512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826512, "uuid": "ceeb2eab-70dd-4344-a3aa-e3b2ee2e516c", "comment": "Malware payload (VIPKeylogger)", "value": "44d9c8d690477f25aa7fa4708288c2fb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826512, "uuid": "8439c18e-f30c-4858-a412-3a982b0150f0", "comment": "Malware payload (VIPKeylogger)", "value": "9bc1a69884f00dac6c99e8f24864b1992f0476ade9a582110d4a8a946b483798", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826512, "uuid": "18db7169-cfda-46d0-8bd0-4ee82ecc159f", "comment": "Malware payload (VIPKeylogger)", "value": "0c8883c22e20257a85b437893420ddbefd69b58a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826512, "uuid": "7c267728-0451-431a-8053-007d20c88226", "comment": "Malware payload (VIPKeylogger)", "value": "45b0521caa65ebc5ef4f6ab5785b1c532080ff4e10c6c2a337e6fb55857bba3405e709421044daf91d2ff0e73b8f0ea3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826512, "uuid": "a1e24ee1-8194-40c7-9df8-1094e116cd64", "value": "T187A40AF5E81978D57F4EF0961828A020EE7C852B6366A4DD706A98CFEE4953F40F213D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826512, "uuid": "903eb91f-aaa1-49e0-b76f-ee3b96bbea2e", "value": "48:UpjtKriuOX87pUHghm2cLY+x+p5cPvUQ2vJKkqSJKxAp5Mp+O9EEpnr:O5uNUg82J+P7CJFJw9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826512, "uuid": "327a76f2-2f41-475b-a50d-5e6763f5b19b", "value": 458734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826512, "uuid": "e8b0b58a-4c1f-428c-a3a4-800d738f6b19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826512, "uuid": "dc0f3174-b71d-43f6-a3bd-eeece134c661", "value": "44d9c8d690477f25aa7fa4708288c2fb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bb85bb-22a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773824590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824590, "uuid": "c63c6082-fb26-46d0-951e-4eca93d35645", "comment": "Malware payload (Vidar)", "value": "2bd99a34558624b84f926577489b5baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824590, "uuid": "9c3ffe33-0da9-4ec2-89de-174edb450a84", "comment": "Malware payload (Vidar)", "value": "9be708d6a2bd1c2523d3cdc119bc075d689db9f3ced7d248f58d524318511e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824590, "uuid": "6dd1617d-0732-47ca-89bc-b33c317b6dbb", "comment": "Malware payload (Vidar)", "value": "0a94b34e84b74d8df1fdcbce7445e8592a7258ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824590, "uuid": "a9ebcbe8-2c44-4efb-81a1-1bf45fe07b83", "comment": "Malware payload (Vidar)", "value": "17d04e21235c4e48e485f28c88014276551f706ff04716a3f76d9420820b1b7733d99b8e4bd1031305a37a71c7a6d97d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824590, "uuid": "a28e0e1c-4903-419d-b678-e12831008b1f", "value": "T1B4A58C46BCE104B6D0AA973689B652A27A75FC0E0B3233D33E506B783F7A7D05978750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824590, "uuid": "8e19ccdc-03fc-41ed-996c-21968e9f955a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824590, "uuid": "adafd879-e8f2-4819-a4bb-43901d114c77", "value": "49152:adayZcd3xmucoQBneRJrC4uhBX5VuchVd1fNAXpszVS:a1fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824590, "uuid": "2d6a9df3-ebfd-46c5-8501-5b1f4e7cbb43", "value": 2063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824590, "uuid": "68029a39-1559-4131-8c91-23163c52058b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824590, "uuid": "20174c61-469e-416b-b165-6b0e340ea022", "value": "9be708d6a2bd1c2523d3cdc119bc075d689db9f3ced7d248f58d524318511e4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6247b0c-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773826463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826463, "uuid": "b50359dc-b29c-4030-8bce-f052b4be4c70", "comment": "Malware payload (MassLogger)", "value": "08dbe7d0039b0c112ea22edb4eb4e64e", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826463, "uuid": "3fcb5639-9705-4abc-a924-1ea3b0849279", "comment": "Malware payload (MassLogger)", "value": "9c23c66da1a8b96e48e659ec201207371a8040cba232bb5dd42f88b99513536e", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826463, "uuid": "c576b6eb-4857-4046-8df6-1ed0c6f4bf8a", "comment": "Malware payload (MassLogger)", "value": "82de77375a0933b69f7edce6db813b8647647d3a", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826463, "uuid": "d015f46b-386c-48f2-b062-26108b911e0c", "comment": "Malware payload (MassLogger)", "value": "a60111c4fc511932b57f0a8bcc047e64913a11553b662865ff0185849c93b385cc6da2c423ce6b954932f6c9a98a341d", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826463, "uuid": "b263622f-9469-4169-9654-2f956d64a24e", "value": "T198A402935AE5CBC8A09F5AC0AA417A57CCF284143A13411C6F57B9FBF4684B9F4E20F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826463, "uuid": "110f0fa9-e4d5-4265-ba45-b417e2614e67", "value": "96:pNCmTeOi7+JWy5PuYGYnl7RsUz1uzIzXz3zEzwpzsz6XX:pPTeOi7Sxpnsc1yYjDMcE6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826463, "uuid": "22981afd-d382-4d96-bd62-3e1d0bf2456a", "value": 457778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826463, "uuid": "65dcb186-26d2-4c62-bb11-36ec1111e27b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826463, "uuid": "cedca16d-f39d-4f6f-8fc8-ebcc2018428d", "value": "08dbe7d0039b0c112ea22edb4eb4e64e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a947dced-22dc-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773846655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846655, "uuid": "14fc46e2-15dc-4c06-a8a5-2a8cec8e7676", "comment": "Malware payload (DattoRMM)", "value": "b85dcb851efb1b5e1ac414f4ecc2ed70", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846655, "uuid": "1dfce592-32aa-4282-bf50-e0c8defbc251", "comment": "Malware payload (DattoRMM)", "value": "9c83aab43c9f3906852e5a7953729d812fd505b5bdbba712fddfa88a554b59f6", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846655, "uuid": "f659f33f-eb87-4924-8660-d4da07191755", "comment": "Malware payload (DattoRMM)", "value": "396bf5ec3d2529a4aca145a8e9e5f725114790ef", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846655, "uuid": "d3137ea9-a8f6-4a2b-a878-03a8e990025a", "comment": "Malware payload (DattoRMM)", "value": "9d24e45d0cc4091168dacecda2e2c9ac84030d27a04c60f56aa4b12ad6e85bc1fbad13fbf8e47c0b72655eb06137c182", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846655, "uuid": "c9dbed88-054b-42dc-9b57-da170fb1c952", "value": "T157B63347D9778DF0CA330A3890D21A6B3305980E485BF4C9E509277ADEF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846655, "uuid": "70fba023-7975-44ef-8678-1a428dc9db19", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846655, "uuid": "b999fd63-ea4a-45a4-8cc9-62a5cd02fa0b", "value": "196608:faZk+wjP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s20:XnymzZFw5S9pE7Asjp29qIT0jarlZr8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773846655, "uuid": "940b6ccb-1250-42e7-b9be-087c63ec1735", "value": 11056040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773846655, "uuid": "892852a5-d648-4542-9547-9bd0c05489b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846655, "uuid": "ff84a72f-1dbb-4a98-afd6-7dc74472f48b", "value": "Ecard_Guest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8889af13-22d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1773844882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844882, "uuid": "60249f70-ba18-491e-98b5-afb26cc84ebd", "comment": "Malware payload (Hajime)", "value": "4658bbf64f1cebb46451626601c73f2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844882, "uuid": "cc965b87-8875-4ae5-bab5-517dc9b67b5e", "comment": "Malware payload (Hajime)", "value": "9ed88743fe9481454ea6d030dac74ff8bca4883dec40b1e77180061c9226d3a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844882, "uuid": "c514df34-4112-406a-8be7-e8718893f08f", "comment": "Malware payload (Hajime)", "value": "ccea841b530a8c9a94a6a594d825cc1fd714ad2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844882, "uuid": "0f548ed2-e014-4a6f-9d4c-ef474648889b", "comment": "Malware payload (Hajime)", "value": "ee7440215157e5e0b5a5e20f4073f7f0bfbbf8fc5eda5dabfc4e81cbeb07055fb863b6053d60107cdcca28bd306044db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844882, "uuid": "28425a52-0768-4afc-a37c-5e9bd0b08da4", "value": "T1AB63124623A92961527145F1E7FD6F8CE10D3A5C8FF16C247C227CACB93235E5CC8519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844882, "uuid": "4374773a-3c1d-4bbe-9dea-9cd13ebf0446", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2v:yYI0ARqw1qAEv7UIFM8oJorFquyjkRke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844882, "uuid": "151cca71-3805-4f9c-88ae-7f407ba7a1d7", "value": 72318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844882, "uuid": "f1d50924-5454-41eb-b5a2-76f03b14e595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844882, "uuid": "bd881c13-d375-40ce-9594-9f7122c483ba", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda9b2c4-2294-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1773815873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815873, "uuid": "ade8390f-d21e-4695-a269-5e04b41517ad", "comment": "Malware payload (SantaStealer)", "value": "0c0fe425205e8173423bf288e09ad1cf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815873, "uuid": "7c127bad-fe91-44a6-9651-7afae7dd6266", "comment": "Malware payload (SantaStealer)", "value": "9ff847266eccbe55815df693cf3f91a87b8a1691b1b059333ca4b36c8157d47b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815873, "uuid": "d3fb53e6-0aed-4e71-b1a2-c9a4f678a140", "comment": "Malware payload (SantaStealer)", "value": "6929f3b721d940181106c51d2e46447da6fc94ed", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815873, "uuid": "1b9f6eb2-e6e3-4755-8ec2-cdabf02a027d", "comment": "Malware payload (SantaStealer)", "value": "a7e8d83a6328bb89b490fbd4d37880bf8459660a53fb0430756b4ed231e35fd43c34bd8c64699d951b81e485378437fd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815873, "uuid": "dbff1052-4ae9-4f04-92db-bb9ee88676a7", "value": "T128267C47E19223ECC46AC1FCC7D7A232B6357C454534ADBB5170F6302E72E9C6A69E28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815873, "uuid": "c155a78f-81db-4378-b023-686258fd3c48", "value": "7af6699601abfecbe02cff5c7eb40506", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815873, "uuid": "e937715a-7cf6-4bcb-a4fa-7f7d0f499ac2", "value": "98304:z6zcwgyzXje8kObpOG7ZE78M1Xh95I7OS:z2TgSOG7ZE78qx9jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773815873, "uuid": "8df56d54-5e76-435a-a692-38b595853cf1", "value": 4534272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773815873, "uuid": "614b141c-7521-4009-9879-cd1ed46c5b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815873, "uuid": "48b35115-e597-47cf-bcab-fc6b364f403d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631c8903-2295-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773816043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773816043, "uuid": "e35ee728-58a4-4acd-98f5-ad66bc108af3", "comment": "Malware payload (ConnectWise)", "value": "e0ab2773cc07e8203a680f6339170681", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773816043, "uuid": "c904bc0f-4320-4553-abae-cff61c5f4524", "comment": "Malware payload (ConnectWise)", "value": "a025f425022df0a0fe1ca8ec5e0554156a49cc2ae302b971878a6e7cc41d0677", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773816043, "uuid": "2e8c2a53-8b7b-4917-8b90-740974426b5c", "comment": "Malware payload (ConnectWise)", "value": "a9c5b069aec9dd4e3608c87d187313cdf663525c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773816043, "uuid": "dc22296c-b534-403e-a6b5-4b4af47f4653", "comment": "Malware payload (ConnectWise)", "value": "4461e84dbf7b1d97054ea4e2734fff30964d2fa66b0005ad748625f6b4632cbdb27c1141e8c83028d2e74afb876c5c50", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773816043, "uuid": "55af80b8-62f4-4f6e-8a24-7d301eea2d10", "value": "T1C276CF06F9E259F6C0BF5635887652917B70BC051B2297EB2B90BA382F33BD05E31365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773816043, "uuid": "5111b4e4-7c00-4134-ab09-6c7467c35481", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773816043, "uuid": "41025e0c-a4a1-44f1-a14e-6735f8fdf2c5", "value": "98304:uQHbG3aWzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlh:uubqhfefPtHxcp9ym3nltDUJVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773816043, "uuid": "be9ce875-b770-4614-91dc-c0163cf518a3", "value": 7694904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773816043, "uuid": "9e24da4b-bdc4-498d-ba6f-9d7e642235a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773816043, "uuid": "cbafb4d6-1773-40ad-a3a6-c6ac378449b3", "value": "d4f085a345cd8a3f662711ea7f8f72084bb7367085912028b7f4acc4e30f3d9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dda7aac-22b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773828838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828838, "uuid": "cf5707b5-60eb-4bb6-8c7b-aba492d34002", "comment": "Malware payload", "value": "8bd80e05746f9bcdfbf84637c35b9a2b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828838, "uuid": "6bdc9b8f-57ce-4b49-ac0e-5a5e783b619e", "comment": "Malware payload", "value": "a153b8ff19d524cb6854fde72cd30374838890e6fd3f94aca2b557c64d250dd3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828838, "uuid": "00bd8f7a-ba61-454e-8b86-a98929e7f17e", "comment": "Malware payload", "value": "bd73cc9ac9f01f916163ff8d148a866e1ab4eedd", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828838, "uuid": "0917fa44-f7aa-45dc-9332-524c0dbece16", "comment": "Malware payload", "value": "cf46f5787fa44d8cf811a41d08b2a061671bf724e39842a2f1c898d1a4ef6396acf144ae331ad8af842a9a0920d1c649", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828838, "uuid": "b8b97046-23c9-4c1e-b887-336b50fd0df7", "value": "T1A221AC1A1AD91B26D332C93700BAE301C720FA66E983CF5C51E051CCAC15A54A87AC6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828838, "uuid": "53a44469-ad7f-4af7-af3a-b38c6afd0836", "value": "24:8Rkem/Zu7vb8A5uKV+/eJ+fTr4I0WL3JXQaR3+9aBEc3CGO+/efm:8yem/Q7H5D1kUIrXv3rvO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828838, "uuid": "b700aeae-2b38-4764-a50d-928ff8944755", "value": 1420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828838, "uuid": "c1132d41-cf2d-4259-8a88-c1bdf638e14f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828838, "uuid": "dce0bb9a-6dc8-4784-9a12-5b5c05a88bff", "value": "tokens.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edbc9c0-22fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773861079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861079, "uuid": "c311b8b7-8f7a-48ab-b51d-c2ffbb9a5c84", "comment": "Malware payload", "value": "e54426fc1a87669af58043b5df506dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861079, "uuid": "87fd7ebe-eaf3-472e-bd70-901d036ac257", "comment": "Malware payload", "value": "a2c3a1892d379740143ff9752fcbf6aac138086e7ea0e36e7f69dd7070d8180e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861079, "uuid": "07b28ffb-15c4-405a-b9a3-26d17385af81", "comment": "Malware payload", "value": "a68c80d10708e5f9021f0d1f270c669c18340f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861079, "uuid": "f533df90-7ae1-46a2-a6fc-02f8e1090a95", "comment": "Malware payload", "value": "51ca6eeec1976431b87c28195c6ee3650df3e71395e3ee1db07ed6a1ad49ca77905c0de9d104e67232f45d4fd049f251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861079, "uuid": "4ee0d883-e092-4596-8b8e-b17270ac806a", "value": "T179187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861079, "uuid": "5d501da1-48bb-486b-ad9a-0b45669e0e54", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861079, "uuid": "7f6f2fef-3a26-46f7-8204-2ffa80e6fcd9", "value": "786432:dAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:dAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773861079, "uuid": "fcec8868-0e88-45c0-bcf4-15f60a75767e", "value": 90267136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773861079, "uuid": "5922ce43-1267-426c-a731-d9235bf75ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861079, "uuid": "de59f64a-923a-4d14-939c-87d2e2e55e7c", "value": "PhantomHack 2.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd7dd0f-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800973, "uuid": "6df00ab6-1dec-4adb-af53-f1b96c7d1066", "comment": "Malware payload (Mirai)", "value": "11edf0bb23a41948440eb4980601cdcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800973, "uuid": "3e03c9e0-7c55-481c-980e-f2f367486518", "comment": "Malware payload (Mirai)", "value": "a30c0a2a4736b7d84b46d6205fde30aec4dc64c4aa518afce8421acd040c2d59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800973, "uuid": "a932f0e6-434b-4c65-9651-8eb6d2095e5f", "comment": "Malware payload (Mirai)", "value": "dfa6dce7ab792bad1034e44b0b93b11a47b319f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800973, "uuid": "581a8a2b-6888-4ed7-802f-509a2bf20f8b", "comment": "Malware payload (Mirai)", "value": "9ad20e4daf1fd8dbe7a975e7e505aa590b88df866ac509c5134bd58047620e32355162ee32fe6ba99e11078bd82d7bd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800973, "uuid": "8af55547-d817-419d-b1f3-e5e75f1243a3", "value": "T1B763A44A2E228FEDF76D863447B74E21A79933D623E1C784E29CD5041F6034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800973, "uuid": "b7281b48-eac6-4249-b8ec-11a89bc5f5d9", "value": "768:KtmQuywFzc3gzKpiRLq54kwOr8cC8PO5fWOnCUPRxT8zCE5Scay/21eo9BDE6ICR:KtwyE+5VwKIeOn31ErSemBDE6TJJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800973, "uuid": "f4ce5ba6-27db-4d9c-b94a-cdc32dc76b80", "value": 72476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800973, "uuid": "85f92de7-1be5-4ae6-9b31-3cb078de85ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800973, "uuid": "d60f3f1b-8e40-4510-ab53-4805e101653f", "value": "dontcrynow.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce3dcef-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827146, "uuid": "2b06d54d-518c-47d4-aa85-b336c36c5960", "comment": "Malware payload (PhantomStealer)", "value": "6a538323abf41f4ec2f1b554b6351fad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827146, "uuid": "c9f3e913-a46f-4125-9299-a421c1a44be7", "comment": "Malware payload (PhantomStealer)", "value": "a30da2d14a67dd7d4299b8e8d9746a0ec7c531d603e47e055f639b458d263919", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827146, "uuid": "09086283-c865-45c7-ab01-5f25889e6ce6", "comment": "Malware payload (PhantomStealer)", "value": "956e7121f8185eea76facfdc998327999f56d7fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827146, "uuid": "eb81d887-b9fa-40c2-b370-506008af0cf7", "comment": "Malware payload (PhantomStealer)", "value": "c9703d53593c5904c123ad3711d955bee542a17155df2c66792d2a38c23c83707fb41e0507f8c2c91b9bcb71a93f1190", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827146, "uuid": "3dbdee77-cb78-4246-b3aa-2fc9828bb09f", "value": "T157269E5EC98D7EE54BF9FA7481F72E8C8B2216E015D6BB0E1372F4C549F6660252AC0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827146, "uuid": "ea1203cb-0c0d-4288-b2f1-e4859e02e929", "value": "24576:ovb+T6Gl+SajGRcWhFsMOfGt+idgKbInoXRs1J3u8aY8k839wDTktzgqgggnJJiK:GvnbpUIURs1pMb+MAg0CcTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827146, "uuid": "ca6d23e7-bfb0-4bdf-8fde-77c7967558ae", "value": 4547605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827146, "uuid": "3f9f1b53-531f-4298-97ba-83fb2aab44cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827146, "uuid": "845b8dbf-6dc4-446a-8290-232f74e503a2", "value": "6a538323abf41f4ec2f1b554b6351fad.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484a6ea1-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800965, "uuid": "18890525-14bb-4c36-b739-9ddd1b6e7282", "comment": "Malware payload (Mirai)", "value": "2f183b4a320807fc13ede04dec3f9487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800965, "uuid": "bd77fb32-04ae-4b1d-bc46-8dc87ab2b0be", "comment": "Malware payload (Mirai)", "value": "a3439ce6e365e42bf6b7e33a9cebea9780f027179f442349c98014f1e9589771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800965, "uuid": "dda89b01-c7e8-4fd6-b890-2108e0e9eb5b", "comment": "Malware payload (Mirai)", "value": "c5920e9353daa63b9e01c1c5857efd6139a0e3aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800965, "uuid": "348831a6-5229-4ef2-9d53-08f19d12761d", "comment": "Malware payload (Mirai)", "value": "452dcd1b152843ed6692eabfaecafc738b156575f4480e97b4b26ea5726933791e10341c291a9c996a23343ea1910b94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800965, "uuid": "33cdb508-97c4-49a4-8ecd-3f9a1477fde3", "value": "T16663095AB9819B15D5C1127AFE0F128E7313176CE3DEB3139E24AB20778B56B0E3B416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800965, "uuid": "1a46233d-0d30-4d91-85ee-7cbd256ea09b", "value": "1536:dAn3KAKwNzFW0Qaa5DN+0MHi+TA4g02/Ql5+YUEV/:T0NEzaaUA4g02/QlkhEV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800965, "uuid": "15a1ffd8-c889-40f0-b684-f5d732301113", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800965, "uuid": "6b381306-f065-41f6-b66c-07b47a113151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800965, "uuid": "896de52a-b4c4-4a24-b8cd-51f01d9d3a09", "value": "dontcrynow.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9744630-2269-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773797317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797317, "uuid": "69befadc-adc6-4cd0-9930-f53725fccc74", "comment": "Malware payload (Vidar)", "value": "c628a5a6f68e28a48b15c0c03db71d84", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797317, "uuid": "7a11292d-b594-45bf-aeb1-1897859a3a29", "comment": "Malware payload (Vidar)", "value": "a3c4b881555ed2eb626b97d1d1e1db4a5b3c1a4d6a4d970343960a031d89719e", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797317, "uuid": "c1e8dc77-1c45-4371-aadd-ef1e8c0bb858", "comment": "Malware payload (Vidar)", "value": "879c296ef0d169a93e1eede95be67d1bbe1287ea", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797317, "uuid": "210bd9b3-516e-4055-bf09-49f511e21077", "comment": "Malware payload (Vidar)", "value": "56757f808dfff6b8f4c826bf15321e60936bdfbd403069ec52df83d47c28b42d7602ad80aa75cb6e9ec2b354c2ae7153", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797317, "uuid": "3b57837c-69d7-46a1-bf11-2671cd1f7bef", "value": "T1F1A58C07BCD144BAD46A973689B652A27A75F8090B3233D32F80B7783FB67D05A39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797317, "uuid": "1c48da6c-c37a-4d86-855e-96b32cf380c1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797317, "uuid": "45e51688-d998-41f7-8060-747f6348ee52", "value": "24576:wtqeInktYPY6Gm0dqjxtSSyEIhZ8dAouX7tNi8VuGiWPK61l:wtQnktB3mCwnylhZ8xmBNi8VJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773797317, "uuid": "02c08c96-c88a-4ef8-8488-a31620a609c0", "value": 2180096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773797317, "uuid": "79700e90-2c9c-4ff0-addd-4c9ad4acc9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797317, "uuid": "f13855da-e276-4bd5-8989-d9a42f031f0c", "value": "setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aced4226-230a-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773866418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773866418, "uuid": "4a052303-850b-4c54-be06-12b2a2e56a60", "comment": "Malware payload (a310Logger)", "value": "3fadc20741d1901f69c8a437a0e9428d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773866418, "uuid": "112c5f16-1614-4027-a5d7-0d398f69d32b", "comment": "Malware payload (a310Logger)", "value": "a461c9d09734b885b06d6c5b21c87b1569d307b5d180ebb83ce89862edef5a90", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773866418, "uuid": "f90c2a40-5062-4c7e-bf87-8853ea3a4b57", "comment": "Malware payload (a310Logger)", "value": "9d31c9e4e43d33885322a35691051d83556bda08", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773866418, "uuid": "42e69acd-d837-4117-8869-722b5856c983", "comment": "Malware payload (a310Logger)", "value": "550558f91fcff12c036306c09281e4facb2c99963e0977367ad14e7f5d22ebacda15472997022a9f739cf97d92f930ea", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773866418, "uuid": "83f2124c-07cf-4895-b4d2-b98cb7d31c96", "value": "T19AB5C052DDC11BBDCA74BE1860BF724BF3B48ACD5419789CD0633E42E69BA34621BE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773866418, "uuid": "16e7cbc9-723d-4055-b588-38e7b16cd956", "value": "24576:QLfhEPWbVQdIESBmarc7UifzgZjXKxNda2YMq6Q9es0Yzm7aRaJ7WzPGv9mKxtfL:WhEPxSMRoQopz614KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773866418, "uuid": "ed66f2d8-9d47-4756-adac-efe1b28e0fa4", "value": 2463533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773866418, "uuid": "c5ff3f08-825e-4a3d-90ac-5a35b5d6fe46", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773866418, "uuid": "fe6878ab-cdb6-43df-854e-b6096642c2ad", "value": "Banorte.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e57a48-230f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773868627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868627, "uuid": "dccf1d93-a6bc-4659-bb2e-a6446dda5992", "comment": "Malware payload (Mirai)", "value": "bac5d437b304a7229c812cdb3374d5b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868627, "uuid": "e20de867-766f-41c0-ba37-c88a035062fb", "comment": "Malware payload (Mirai)", "value": "a5644495bf8e536a74c64bb6ef1ce61015180577f39f0c87349f197f69fd60ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868627, "uuid": "f767a185-10ce-4b67-91ee-749cde7daa26", "comment": "Malware payload (Mirai)", "value": "d1ccd3556b9429cec8544395d1533e892b03eb59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868627, "uuid": "aa3f2d9a-bd9c-42ba-be3a-7e59305a497c", "comment": "Malware payload (Mirai)", "value": "031f39975c41f7267926eabaf37e9d4cb4a0252060b09b6febb93edf08f6ac62107c017b1a215be92d6e02c74bfadc2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868627, "uuid": "9e40663c-022a-4cc3-879b-9cd293dee62b", "value": "T1D3C3A7493E219F7DFBAC823447F78A21A79833D536E1C685D19CD6011E6034E686FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868627, "uuid": "2311f9ca-4c58-4d89-8423-7a285f40f52d", "value": "3072:rKbzLfl8LzyYl4xdk2/mW1VAKEnvchlhbOu:KzLfl8vok2/mW1Clvch3bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773868627, "uuid": "0e42700b-8491-4dfe-893c-48ea5e681160", "value": 121416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773868627, "uuid": "c035d1bc-9ba2-4493-9abf-c5cecd7b862f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868627, "uuid": "e9e36bbb-7c5e-40e2-b5c4-b2b8b59a7c12", "value": "tuxnokill.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ae349e-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773825192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825192, "uuid": "8caea259-7787-436e-bdfd-5ce6470e6764", "comment": "Malware payload", "value": "2d455c7de272ac5fc11c85cb94e459cd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825192, "uuid": "1972e0fc-7ce5-497f-ae55-db965227cf46", "comment": "Malware payload", "value": "a5e647d7d5102b888d0da7e0299cad78e15bb835a4e4120565379e8337485a82", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825192, "uuid": "d0a9b9de-e0bc-48de-b8a7-a9a1b9d42184", "comment": "Malware payload", "value": "89535123c821055006ce10a7c62242b4f34d1222", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825192, "uuid": "c09aa950-7e0e-4d73-a519-72b2cfcb0d3e", "comment": "Malware payload", "value": "b0bf325fc1015411d42d18a67759a0e704c311b94154dc70a3a1f79710ff526adaf46e49c8cc56074266bb63eef26f2a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825192, "uuid": "da58ca37-9653-42f4-9761-c1c08d55f9ab", "value": "T187F41211B8652833C6EE5E3426854AA14C2EFC467A5DFC4BC2C833EE2F749F17067998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825192, "uuid": "dffbea13-e384-4568-9494-64aee4d50494", "value": "12288:3Kzv00rSN0LabXKpKzv00rSN0LabXKbOXoOgw/+y5ZlOesv/:6VSNbpVSNbem+y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825192, "uuid": "f9a3a90e-61f7-4171-8d98-d37d8576623e", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825192, "uuid": "84d4acff-f065-4065-97d3-aae442856b10", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825192, "uuid": "43bb54db-b80f-464f-a6c6-7e379b78d138", "value": "2d455c7de272ac5fc11c85cb94e459cd.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41eafbff-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827154, "uuid": "fdcf6419-f425-488e-bc4a-1079d87e87f5", "comment": "Malware payload (PhantomStealer)", "value": "772846f566e405dcabd6bca85eeffc26", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827154, "uuid": "7ecf38cf-7d48-4eb7-8788-0fbd6879b6df", "comment": "Malware payload (PhantomStealer)", "value": "a6fd0930feb3daf8b3b42f9ea33240ad7829f018708e1a65331e0f26fab50960", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827154, "uuid": "1bbcc3ad-384d-4e0c-abfc-1a701490d9c3", "comment": "Malware payload (PhantomStealer)", "value": "1799067faf81c8448b887cf140d84ef0244fd08b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827154, "uuid": "0c68fa95-7baa-488e-a4c7-b6ae91d3b152", "comment": "Malware payload (PhantomStealer)", "value": "9e91079d383045f4aca8957eff4799d05e32e37f39b053b88ca6d1038d9211eeb694daf09d5451e6d9c8ec6bd9b88e28", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827154, "uuid": "820e3759-9f45-4012-ba5e-fec209563b9c", "value": "T1D6C2979D3EC3B1389225A0F36927A0667A6D9CC47308C456FBE758DCB92C334E175A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827154, "uuid": "b8e0b68b-f83a-49b7-aba3-cb2c082b8e04", "value": "384:VN+cDppmOXtQII0YeMKWmamyQMwv4d0gu2dins2a0ifoDlLIpE1m1NkGX1e1q8:b+avmIfYAWMvs0gRUswlUxtgA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827154, "uuid": "abd5bde9-236d-47c3-8935-e2254dc633d0", "value": 27949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827154, "uuid": "9c9a4f16-cbbf-4be5-aec0-d3999b8f603d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827154, "uuid": "cac49647-2266-4964-aa78-7f71fa290ca3", "value": "772846f566e405dcabd6bca85eeffc26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45679645-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773827589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827589, "uuid": "7eb0a212-3b2e-4c1f-b6da-af2a12c4e386", "comment": "Malware payload (AgentTesla)", "value": "f9459e990fdb07044cd3813f6dc86e96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827589, "uuid": "0f7083bd-0f75-4606-80c8-9e3c3b608338", "comment": "Malware payload (AgentTesla)", "value": "a737f9c95027b8ab3b11ea18fea07f8670cb4c767d7c5ff260dd7e834f1cfd43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827589, "uuid": "607425bd-776e-49f5-b621-43b34f08e85f", "comment": "Malware payload (AgentTesla)", "value": "7151b9803a98f2c166817f681cf3d6352683c75c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827589, "uuid": "9492b72f-341e-4c23-b8dc-a56b02352c64", "comment": "Malware payload (AgentTesla)", "value": "f9ad2cde718972235f343b61c2654d34b303193230a73ddb2fc0e6c044589b9a25d43056f1a67af99507411039beb955", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827589, "uuid": "84b9b2c2-6d8b-4990-847a-d2ea58b7ce23", "value": "T1E845DE9EEEEEBD603451C394C45F68F5860A6010893EB587694CC293286CF9BDF1ED8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827589, "uuid": "86c225d6-1d15-41cd-8332-6cd0cfd21424", "value": "384:srPCmknSjYn8+NtNdp6OGw9tTjPNshP03cCo6VPx8thDNdtwsxwNKtd3jtWXNeLc:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827589, "uuid": "e5012ca1-1e42-41c6-bd1a-e2aa5c263b1a", "value": 1198106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827589, "uuid": "5192d248-26bb-48a6-9c6d-8357241da251", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827589, "uuid": "34ee5ea1-22a9-4856-8ddb-251fdfb9cbff", "value": "f9459e990fdb07044cd3813f6dc86e96.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dab7610-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827093, "uuid": "87436ffa-c694-4623-abdc-a99fe1b60a35", "comment": "Malware payload", "value": "977517998492751a7c4fb23fea9f2ba4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827093, "uuid": "150a1a6a-926a-4b47-9776-4cb0c3bdd7cd", "comment": "Malware payload", "value": "a7cda97e31774d2a2f98f3da07d3817c53c0461de772a0c222549129f05a23ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827093, "uuid": "bb44787e-7b57-44a6-a299-9d01b5397188", "comment": "Malware payload", "value": "9cf207bfcf75e387e9c22ff9d033a4355f3c2d0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827093, "uuid": "95ac5dc7-b335-417b-a151-8e899ccc9ffb", "comment": "Malware payload", "value": "eaf33e2b8352b1ed68c6d29f898cf15868205f6b5adfbf26e94df8c1edd7792c73768cd7521a4cc9990e7d2f2e41b7ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827093, "uuid": "b57d2296-f8bd-486a-a43c-71c340e890f7", "value": "T10DF302F5162F12851B23BDF195D30B446BE62D7798722188FF8DE8463CFF9009A9174A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827093, "uuid": "7ce84e8c-1818-4ac5-911d-727ae753fca6", "value": "3072:+8IFJNST37OMMAi6wy56Y+/Eg/jQmZqreD4iwT/wF/oQlU3F:+HLN83adAinG6Fg6fFZy3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827093, "uuid": "6deaaed4-31a6-459f-b96d-e4f036d87188", "value": 160020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827093, "uuid": "31c5c034-c3c8-4625-aa15-9d3aab0d8510", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827093, "uuid": "21628ee5-6128-41d8-9dbe-3e6dc32dc8d1", "value": "977517998492751a7c4fb23fea9f2ba4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8624a381-22c8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773838006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838006, "uuid": "50b27587-4b89-4965-9d23-6f476f3b2349", "comment": "Malware payload (RemcosRAT)", "value": "5e7331fba875a69fa8fb2b01992a3501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838006, "uuid": "5ef269c7-a761-49f2-af24-f617a837246b", "comment": "Malware payload (RemcosRAT)", "value": "a9cbb1b3305d042e03d3e94b2d9cb93e46a230e150e9843a837749b0217a0d2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838006, "uuid": "a00ac250-8ba4-4bfd-917d-d0dafd0a6c02", "comment": "Malware payload (RemcosRAT)", "value": "6d7e6d6cddd4c1d32f775f94e094ca4abd3bec32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838006, "uuid": "1cf83347-fd14-4464-8cb3-a805d1621954", "comment": "Malware payload (RemcosRAT)", "value": "acfb915bcfa0536ab545adccc95e75cad06ec270a945c5a9a86bbc5e0c0ab8297bb8ccd25b0b0a10cf843a7fc14b62e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838006, "uuid": "fe9ac487-a2ef-4ad3-93f3-3f5139913dd7", "value": "T1AE635609CE437C93D29190DDBB7720AEF91639E030AB16534DA7BEB8B745281F95D08B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838006, "uuid": "22a74f71-4826-4453-8903-fe47d4e7a05c", "value": "768:j0W/O9v6srEv0Vty22/etfhcdagg9dvrZJoFqQ:j0W/O9yqCgy22Kfud4dDAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773838006, "uuid": "55f93823-9116-4f59-981c-e12ce25bfb94", "value": 66848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773838006, "uuid": "909d5880-e5be-4570-be5a-05f0473ebc5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838006, "uuid": "b170fcff-429b-413f-bfc9-524a729a0a83", "value": "license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cde5e1-22a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773824871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824871, "uuid": "53ee2acc-9695-42d0-bd95-c2e2d357804a", "comment": "Malware payload (Mirai)", "value": "c18d5d882fa0048b9ef2f2ec328a20eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824871, "uuid": "242ef7bb-506c-4f8c-a5bf-a9b6c075fc59", "comment": "Malware payload (Mirai)", "value": "a9fb49c5dd0ee89153ae14210d0d1d2a27e026fdbc958d7cb75f418c7f6d485e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824871, "uuid": "8a38cccd-5df4-4e73-9b65-8b6a5f7f9ffa", "comment": "Malware payload (Mirai)", "value": "f67b1f7d818e6b167ccffde00837b17ebf89396e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824871, "uuid": "5fb14bc7-422a-44e6-8eb5-9402cfec0491", "comment": "Malware payload (Mirai)", "value": "ca35b0a9e0e6004a0e203fea064ea57a5e88c4f5bc1a986e36be7c75cb36d1e570bf7baef4f677982b99cc7b5908620d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824871, "uuid": "28c91521-a95b-4893-8e23-a1c4c0afc3d0", "value": "T1FF242955BC415F26C6D126BEFBBF81CA33132BFCE3DE3212ED0457153A8A85A0E26552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824871, "uuid": "080773ea-8f1e-4984-ab8f-7b1d4e966fb7", "value": "6144:edYCuhU7/+LZmpaa/xJHE2Kpj3f98QXugFcYdSAaD5QjEXi+g1pVd6ykA/3:fhG/faa3HE2KNPmQXu8cYdSAa9QjEXiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824871, "uuid": "8671c623-b75b-4063-b9c8-3dcb750f54ba", "value": 228548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824871, "uuid": "843ffef3-e6bc-4ff5-98c0-7fbff32a8c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824871, "uuid": "559877da-eec5-48d9-befc-93d7a2f84b51", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f8b672-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826998, "uuid": "f581dcaf-611d-4c84-94bd-85c5a0585953", "comment": "Malware payload", "value": "c1f1cacc47b598efe604f00a559dcf6a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826998, "uuid": "eaf53f47-5b33-445b-9b9e-44dd784fab4c", "comment": "Malware payload", "value": "aa5b97546a5cb1e62fbacc5f8521a7fc593ed37b11604966a87b464b9bcc1eb2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826998, "uuid": "60c706cb-0255-4087-8cf6-02267e0657f1", "comment": "Malware payload", "value": "460426f1298e83a4464ae117e2cc59c871e6689b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826998, "uuid": "c683296f-c656-401e-87e7-850d369bcb7f", "comment": "Malware payload", "value": "44a1d379eb92031cecfd78ca7f70685500cf1a64ff1305e64b8a06745e6bafef4247d134daf7bb577c6a1cf080178f1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826998, "uuid": "b41353b2-72cb-45c0-bc68-001b8c620ce4", "value": "T103B4EDDE2EC1F15E0F816D33F21AF06DF4F5A8F0536A9C58A0CD2C58E891AD4AD59239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826998, "uuid": "97d3c6b4-7689-406a-b81c-d4832b2ecb43", "value": "6144:ksyLD7xcqdo5m9nRS1tbJD9mlde/jUr+dAn1Ix717:ksyLLoQnRmtbd8lda/K1+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826998, "uuid": "fc0eee1d-5da3-4a27-8d25-f4a5986ae8bc", "value": 523958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826998, "uuid": "34b3392f-0448-4adf-a429-4f5299ca7c1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826998, "uuid": "af8698e0-d63c-4ee1-9ee8-efc72ea204a2", "value": "c1f1cacc47b598efe604f00a559dcf6a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccf1f99-22da-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773845909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845909, "uuid": "03d67382-2482-43ee-9b91-cc9e69d59a0b", "comment": "Malware payload (ValleyRAT)", "value": "93578c97850624365f00fef330f0eea7", "object_relation": "md5", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845909, "uuid": "768914b5-1347-49d0-b338-c01507ef4789", "comment": "Malware payload (ValleyRAT)", "value": "aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d", "object_relation": "sha256", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845909, "uuid": "31b26b2f-2617-45dc-9eee-cdef065042a9", "comment": "Malware payload (ValleyRAT)", "value": "8c44fa744be137f8bf8fd0ab15dac19f86ed8b01", "object_relation": "sha1", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773845909, "uuid": "e7474d10-7073-4371-8ddc-552680ace223", "comment": "Malware payload (ValleyRAT)", "value": "402e7df8ecf037805239bce3100c674c9565262472e96c44cce5abdebc1ec399b4ba40b85c44b6cde00c2d7a4debc5eb", "object_relation": "sha3-384", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Vigorf.A", "colour": "#0808D7", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845909, "uuid": "e0437115-2102-4204-94d4-1a3f5fb21a7f", "value": "T19926330D5A07866A5CBCAFBC62E4ADAF03B72BDA06F61C5CF0AEDBDC55DA3740121054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845909, "uuid": "62b2458e-9340-49d7-9fc6-d33fa5cc8630", "value": "98304:4UWs/1PkRvKAYsTi1w8rqM+SP9EIaCUKLdKjQUO+Q8vFbCjzt2d5L3WmFCe:yG/RsJGqM+SP9E30d27Q8NbrdQDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773845909, "uuid": "a68c4307-82d1-43c4-9591-b5f49cff27fb", "value": 4838258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773845909, "uuid": "220d0d09-39cd-4c4a-8b41-5263bfc8b1bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773845909, "uuid": "323f6021-090e-4189-a113-b3211dfc700b", "value": "\u30c7\u30fc\u30bf\u30ec\u30dd\u30fc\u30c8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56eb106c-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800990, "uuid": "eb9ac25d-8914-4f42-95db-8f9d24bb8840", "comment": "Malware payload (Mirai)", "value": "d7778079f3046ec7d05257f2ebafe2cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800990, "uuid": "6e80c204-96bc-492b-98e7-984a25eee40f", "comment": "Malware payload (Mirai)", "value": "aa970413384d60bc32c586bf9ba613bcb15c41b11344bf14bc530aa910a1dc82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800990, "uuid": "275ffe1c-e50c-4556-82ff-2fab37ee0082", "comment": "Malware payload (Mirai)", "value": "d193702a5858f01b76b17947570990ca4410d1f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800990, "uuid": "64fcf907-bb68-405a-abd9-44c897e56d95", "comment": "Malware payload (Mirai)", "value": "37d797561927af673f8ba89d801643d291e4720b507e75bbbb2ca10b7d2cb3249dc9435e87ff8d2452f86bf822563f45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800990, "uuid": "4a66646a-7867-4366-beb8-0939229fd58e", "value": "T1C1332C41B31C0543C1B36EB0363B2BD0E7AFAAD122A4E385751FE689E0B5D369546DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800990, "uuid": "269e29bf-46f7-435b-b8ef-5e8418712387", "value": "768:2K0TueaZsPSAomP6GGkl9xyT1ijF72cHVJTI5FeztVpjxUEoIw:BcuXzmyULxS1892EVC6z/8Eoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800990, "uuid": "4e5af8af-9d01-4ed0-a928-f7362eb30ee1", "value": 50652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800990, "uuid": "e69a5c59-7185-4ce3-b6d5-836c1df5322a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800990, "uuid": "e5d2d345-c861-4ebd-85f8-05f11d99f821", "value": "dontcrynow.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f58608c-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800950, "uuid": "96917088-2a8e-4fbc-955c-a953a4dfd12c", "comment": "Malware payload (Mirai)", "value": "42c0ad0e825ba50b90ca6ec79fcddd22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800950, "uuid": "df5c7d49-3fac-42ee-a1e6-d50f480b971f", "comment": "Malware payload (Mirai)", "value": "abf52a11e992dd93925a268fd70ad77423bfcddfa4e579a9e668fd0f07e138d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800950, "uuid": "e50ba368-8a7d-45df-b04e-d3b5cf9a715b", "comment": "Malware payload (Mirai)", "value": "ab0dda872a334f41dd8f1ddd588ee73450ed0379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800950, "uuid": "ffca8556-9f91-4528-b4ca-02f76c1aefe4", "comment": "Malware payload (Mirai)", "value": "7cdb3d6843ff143d1e011664a319a635dbc91d0fd471bd30985836d5c0e500387d7e91a22b8f5cea84803ca4edd7f3f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800950, "uuid": "ec90b12e-f85f-478d-b0f0-718fd6a1f2f5", "value": "T12C136CA3CD362F28D6688575B1215BBD5B23E954C24B1EAE8076C239D103EDDF4893F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800950, "uuid": "2ec4bbec-09c2-4309-a168-bbd9567a9fe9", "value": "768:LCZU4sSYCAKbIlwFT92P2TKGmpR7famXoLEGQlCBADFEfMUQE0I:KUqYCAUISlwIKGmpR7CmYLClCBY7E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800950, "uuid": "64b0c42d-9ca8-4c4f-ae82-f5d7d1f49133", "value": 44204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800950, "uuid": "5c38e267-53b8-4fa1-9b8c-f76a9d2e34af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800950, "uuid": "6462e5b7-5436-4b27-b50f-1505d22696a9", "value": "dontcrynow.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61befac-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827430, "uuid": "80fcb6f2-c50f-446f-8b7f-9ccf4c0e5295", "comment": "Malware payload (Formbook)", "value": "215bb4208df88d2e4f7fabfeb67074c0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827430, "uuid": "f7a4dda8-a58e-4ee6-aa12-66f27029bab2", "comment": "Malware payload (Formbook)", "value": "adbd250c02edbc701593abcffb08ac230f105cf9982ac0c694f8978a758363a2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827430, "uuid": "1f901e9f-77ac-4b4e-8c03-085581c8d2b6", "comment": "Malware payload (Formbook)", "value": "442082aab1c4e2216e44929a9f0188947d128d7d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827430, "uuid": "7803a997-f8bd-4bde-abb4-11b4522eeff2", "comment": "Malware payload (Formbook)", "value": "2d0daab36bc8b00d78b1e1cdca3112df2fb3290507fefc7e2a9865b76738351069124a6c10b61fac1b8e01e53d8e7bf2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827430, "uuid": "ac0b2292-5ae1-4b76-86e5-ea03f567d091", "value": "T18D6502A884B8BCC74E4374C594952D2E962E853500F767801ADFAEB3153DE7726E0CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827430, "uuid": "65a89500-0eda-4568-bd82-c9684cefc886", "value": "1536:5uHtR1NxK/mg8n3CmDNVgqPxsJJGx+HxIDt4C43d8JTJVfY:OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827430, "uuid": "c95ea402-f952-4473-88ee-60c430cf47eb", "value": 1469946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827430, "uuid": "857268df-7bd5-49ee-9d35-b6e36149188e", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827430, "uuid": "b2075f24-a6a1-4714-a8f1-58ecfff8f85e", "value": "215bb4208df88d2e4f7fabfeb67074c0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b44039-2292-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773814859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814859, "uuid": "5c1602e6-e80e-4708-82ec-f27c2189d5ac", "comment": "Malware payload", "value": "e96077c8967ef8c5c6c785d0e9d39841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mann-Technologies-LLC", "colour": "#E9C3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814859, "uuid": "b6453c95-17cf-4251-ac1c-e7785d75595b", "comment": "Malware payload", "value": "ae1404972edf59527ec0d2e399000513c09dfbb2a6863a34d396805ef1787d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mann-Technologies-LLC", "colour": "#E9C3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814859, "uuid": "94c87616-22d3-4865-92f9-122729b2ef96", "comment": "Malware payload", "value": "79390e535ede93146a15a9aaff95edafe899c430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mann-Technologies-LLC", "colour": "#E9C3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814859, "uuid": "f6173c0e-4387-4370-b1d5-1d936047ca33", "comment": "Malware payload", "value": "285ca69282b8f86b61d0a5450feb52aa30aaa75fa160c063de988bec9747c36479f705126e149f18bbbcb93e724aa584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mann-Technologies-LLC", "colour": "#E9C3C3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814859, "uuid": "d24d36f9-3e80-49a6-a757-8e8111bef089", "value": "T1EA265B03B278653ED457DA3E583FE6409C3B7E212A2D8D0A6FEC3C5C8E365416926E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814859, "uuid": "0901aa90-080a-4e3e-97c2-5ccc52bb38bf", "value": "4f3a70412c909e6e8f69020f0bee4f39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814859, "uuid": "a0cd7999-df23-4893-9efc-f12c50b20839", "value": "98304:TYU5hnuOajWwMPdCpepI3GrwrA+Jn333QM7:NxuHjWfZIzcM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773814859, "uuid": "48d0d3c3-84d1-4929-ac81-80f8d509aaf1", "value": 4720992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773814859, "uuid": "14fe3965-179e-4466-aa02-69eb73ea0716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814859, "uuid": "fbd76fcf-43fb-45be-88e8-6a2aa86cb1fe", "value": "ae1404972edf59527ec0d2e399000513c09dfbb2a6863a34d396805ef1787d1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db44fce-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800948, "uuid": "44d961d9-d6cf-41b7-b15d-9e4319b1ac45", "comment": "Malware payload (Mirai)", "value": "cf01097723fc1f1fbe989fcf387f8255", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800948, "uuid": "5af46579-cd24-4c51-87c4-5172e8494c9f", "comment": "Malware payload (Mirai)", "value": "ae5865c6f0d7e4839d9843f6871a4b756bde4346f70ea358988a3c49132d0919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800948, "uuid": "e2419fa4-c011-42bf-b3b0-6f327f4af68a", "comment": "Malware payload (Mirai)", "value": "8f076bef53c3536209cc07d2036e5d813d5fdfcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800948, "uuid": "d9bcff05-22ca-4189-a29e-7a731afbfd8b", "comment": "Malware payload (Mirai)", "value": "58a330bb755bbb01c2a15dd754885e6b6ab2e310608658fd29005850c3d5c1ba9d19706c781fd8a00e34df80e8d89d9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800948, "uuid": "bbf2f538-4a33-4862-823a-73a9f2ab7716", "value": "T119B2F1311A963413E870E935FF70DE8A118952BCD5EE70A1322617B8AFD914B3BB41E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800948, "uuid": "cb7dd6e8-56cc-4077-875b-4cde585b37ce", "value": "384:brclVS7eDf6hvO2Tl4XRcdXQIuztRtE2+kdId7Fr5wxdjBDWuVYI9wvVhymdGUoT:bwlEi3fbDzHtE2r4TiFDhYI9AVs3Uoz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800948, "uuid": "c034a83d-2539-4dcb-8e08-a28e0d0ac868", "value": 25288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800948, "uuid": "be2ee731-eea1-4e96-a413-31cba1d66289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800948, "uuid": "b7ce368c-f6fc-481e-b862-7bbf8ac0b598", "value": "dontcrynow.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f16ecd0-22a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773823713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823713, "uuid": "fe388cd0-91f3-4821-bf4a-a86b21dc02c7", "comment": "Malware payload", "value": "ce4502d88a4255365e34d497ba370524", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823713, "uuid": "4d604e41-dc67-40c2-a16c-14ba40ceb9cb", "comment": "Malware payload", "value": "af30d3ce15e59ed0761a5a95d3fbd7daa072a72e2554fde870c82651693e019f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823713, "uuid": "8d3bc6ab-3874-479d-9049-c2c79cc93732", "comment": "Malware payload", "value": "bc6622883b9fb43ca2c2e0784c5f0aec2c7a5409", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823713, "uuid": "e481dffb-96d1-47a1-b7b1-f39f581ead3d", "comment": "Malware payload", "value": "2d7779cca31b5a869e63181e235ea345139a7b497db5ed7ab759f6f0028c0fa1b3f226ba90947292dc1ded73d4870353", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823713, "uuid": "b1c24ff4-c37d-4a6a-be44-d5676fd45ff3", "value": "T111E0F121671B310F9BDAC992494C91DAEADCD2CC133A7AA759C4BC001D857CA5B5F119", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823713, "uuid": "46b6c8d2-eb71-4f01-b742-3140a4e55dea", "value": "12:wbYVJ4JFVqn984CXLgyaIS1PKC2ALFyGHDfhu1MnGBk1N:wq4jVaEXLw1PKC2kFHD3/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823713, "uuid": "7c6bc267-edc3-4c88-ad24-2a620d971b63", "value": 409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823713, "uuid": "8f7fd909-a8fc-4791-9985-50d4fa5e8cd6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823713, "uuid": "cf3f6872-77da-4765-90f7-9b0c6314b3fa", "value": "mego200.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1078abc-22ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773861700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861700, "uuid": "9a6e7988-5306-4f68-84c3-f6892f61426e", "comment": "Malware payload", "value": "809b2e371f6a92fee63902598761fbf0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861700, "uuid": "d8e13c78-e860-4ce1-ac4f-a3ae9415507d", "comment": "Malware payload", "value": "b05377b492f5773f27febaa9d0a70f3bbbd8d69f7f6b9d1d69514ec878ff621b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861700, "uuid": "da980c3d-b8f6-4e6f-9076-8451cc6d83e4", "comment": "Malware payload", "value": "21a9f0df42a21168c41511f6a1e2e80aafbfd217", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773861700, "uuid": "bc8030d6-8125-4f54-a594-dfdedfc68aeb", "comment": "Malware payload", "value": "aa03811c3ed374d121e92f4785de769ce644c21771e800d468270014e27b4881d779de11fb587660bdf4513d58f6b170", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861700, "uuid": "5abf9628-e09b-4949-9d3a-27f900df1cda", "value": "T1D45733A7E0720997DE3BC8354FF96A4589B03E5508839D4376D2B256BDF3B2032BB059", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861700, "uuid": "56f429e0-54bf-4ab6-892e-83591d49f781", "value": "786432:VPUvJiz4oMkUsWJE3ypw/JdyomE79mPjUTg1ARh8zJfaJr:trz4oMtE3yihdyLEqjkgQh8z1aJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773861700, "uuid": "404606fc-3223-43f0-bae0-6505f2996b07", "value": 29511680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773861700, "uuid": "10f5d418-dbeb-4c06-a2b8-be4d325c1f37", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773861700, "uuid": "ff499495-ec9f-4af0-b715-e29d48812f83", "value": "Extreme Injector.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175ca5dd-22d0-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773841256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841256, "uuid": "9b54180a-74ec-4aaa-b449-d525b009be73", "comment": "Malware payload (XWorm)", "value": "004eb763047b02f7811776863b415d25", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841256, "uuid": "dcc42060-315f-4ed1-83b7-d24c526408dc", "comment": "Malware payload (XWorm)", "value": "b05d4a40c8aa32ed95e92b93e4ba846b59ef36eea72309213ada50633023c67f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841256, "uuid": "08631bdd-d818-4ad7-8305-1b534023481d", "comment": "Malware payload (XWorm)", "value": "9a00d06939dbd3fcdb605ceb31d449c8d39d1739", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841256, "uuid": "e4bdc0ab-2733-4292-a976-209245fd01b7", "comment": "Malware payload (XWorm)", "value": "799de988dd14004a21032a2c57101d840c34a085aa1792696f10f6634579dff7626bfe946335dd3c9bc6dbc3213f7a35", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841256, "uuid": "2ade1d37-3f2a-4792-96fb-1c8fb58f6b74", "value": "T13E51231823EF9724F3BB4E7A2DB6C2904632FC51ACA6E35E2598028C6435714ED71F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841256, "uuid": "e25adaa8-fdac-41fa-a651-09f271ca02dd", "value": "24:8zJRscSXIEQ7AZPx+/+YjNgLOySU4Ug+/2xaiTi/T4I0zdyDM1JdzS/Lrt+hwvaH:8jscdUZGjiL+Jde/MIsyDM1C9rn8drI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773841256, "uuid": "614937eb-8ddd-4aa7-8fff-487758ba18f7", "value": 2830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773841256, "uuid": "3b9aabae-4832-4b31-9ef6-e5a2d9457d7a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841256, "uuid": "b39cbf6a-c282-44f0-b7dd-1a6e8749dee5", "value": "GENINSTRFORCONDUCTIONLINECONDUCTOF66THDEEAWANTRGIHQA1771589777[COLIHQ_CC-17719928838].pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4d38a2-2267-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773796271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796271, "uuid": "518c2ef8-47be-45f4-817c-9303c4a94707", "comment": "Malware payload (RustyStealer)", "value": "61c3d1c147dc14830b24dd06700ce029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796271, "uuid": "4cc7c849-5853-41a6-a6a4-b20554564be1", "comment": "Malware payload (RustyStealer)", "value": "b08da7db6d928857eed0a404b54a8b74e876c3d75378fb001b3ce50bb47ac138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796271, "uuid": "2dd6c364-14b1-43bb-8f53-222bf16cc94e", "comment": "Malware payload (RustyStealer)", "value": "74fdd324a64eb824ebbbdd63c17d111a93d018de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773796271, "uuid": "d76bc082-1bda-40b8-a487-cf619e7c920d", "comment": "Malware payload (RustyStealer)", "value": "85b0aec1a9e55f834d55bd6c9f750f1c455189b5807157eea3a5e2c84465de1e7a962943ba3b10be740547dccbdd696a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796271, "uuid": "ea0c865d-9405-4ca6-a2a6-f31464d2201d", "value": "T125047F17FD846DB9D18FC074830686525636B8CA0F1199FF13A42234EE69BF67FB460A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796271, "uuid": "5139a389-e0ef-4fdd-9c2e-3e77d6af27e9", "value": "0c46b7f311345794922e656c0b8f9cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796271, "uuid": "688b06b6-2a59-4442-879b-28dc46958ddc", "value": "3072:W3tjj39dXQrRnq3v02CIpJBMU2XHuzNFnnVxBG:qxdXQF20cp3gss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773796271, "uuid": "ca554138-022f-45ee-81e8-9373806b34cb", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773796271, "uuid": "deba2670-6b27-42df-87af-dbc6467e1bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773796271, "uuid": "9b57e67e-4be7-4358-8845-e190bed76d94", "value": "\u67e5\u770b\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb1daa2-22dc-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773846659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846659, "uuid": "dd0dc2f4-7976-439b-9f71-6a3f2b81e0e0", "comment": "Malware payload (DattoRMM)", "value": "ad0db43fada98cee5c931da80b76fe97", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846659, "uuid": "8dafa5d1-1dae-4af8-8ee3-c07bb1b210de", "comment": "Malware payload (DattoRMM)", "value": "b0fd135e78d5f26c8d4c0da5e59cab8c57c5b5426fc18fff25fd00c552c6dc3a", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846659, "uuid": "db8924b8-5151-4940-9ac0-6b3d834be396", "comment": "Malware payload (DattoRMM)", "value": "cf446a4a3ed12a33be994d85eacba3cd5b2623b6", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846659, "uuid": "0c316bf8-44d2-4fc4-b2b1-edcf76da6b07", "comment": "Malware payload (DattoRMM)", "value": "3aec186dfda176a40814546fa32967b350fe440eed224c26fd7e9c5aa8ceb385c73471d98d5c80151fdfcdceb7e9d43c", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846659, "uuid": "8b554a4f-f304-4040-a289-2b18278ac7f5", "value": "T1C1B63347D9778DF0CA330B3890D21A6B3305980E485BF4C9E509277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846659, "uuid": "ab89f3bf-4859-4eee-bb58-e888a8ea9a3f", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846659, "uuid": "4e1433c9-c927-4560-95f5-3bfe92efd181", "value": "196608:caZk+w+P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2h:un5mzZFw5S9pE7Asjp29qIT0jarlZr8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773846659, "uuid": "f5e2b840-b891-4270-bcd1-d7ea47ef36a4", "value": 11056048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773846659, "uuid": "9055d108-9d73-437d-98d6-630847baee0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846659, "uuid": "6172954a-1647-4e7b-b9db-22fd774014af", "value": "MatherIAndersonLaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcf7381-2308-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773865587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865587, "uuid": "a25fcf44-281f-4793-a1b1-0d60e77a53c7", "comment": "Malware payload", "value": "45f71b40a4652d34f6cbaeb7dfe862b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865587, "uuid": "4ee9e653-0638-4969-ab2d-e7cc5e5ad438", "comment": "Malware payload", "value": "b1317e779900e35e0e0bc965776dfd4f26bcd27a9709ca73fa13606dc6e7d7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865587, "uuid": "bda5a33a-1b08-4d89-8a34-56cf79385dbd", "comment": "Malware payload", "value": "3be8d58326adb23eb48eb61c3213f9b3ab93d54e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865587, "uuid": "c62f809d-f9f7-4e7b-bb38-462d9de7ea70", "comment": "Malware payload", "value": "b562a4ad08c1f4922f6a1eafd8a9e2a728281e6bb1bc609172a3b318ee4704f2ace34bfc69bccce07c550f400ecfe2b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865587, "uuid": "edc29a05-6f9c-4498-85e2-4581ee0161cb", "value": "T1FC669D14A3E801A5E57BDB34CA15C333CAB07DA25635D10F0998F2462F73A62DB6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865587, "uuid": "f7e4ead1-2f86-4bc0-b396-f4773ee02c6a", "value": "9c982684232e3382c1a71cda826895d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865587, "uuid": "82216610-db8d-4e0f-bf9c-6fc1486c1be5", "value": "49152:0B6/GJSKxWGHMo8NDtrwtA85LmExGyXTv1XfHbQi3e5bJAZ1ySod1byAC9ScppzO:S88lKc5UyXJV3e5WppzXwEJyDETi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773865587, "uuid": "9186f734-b62f-4ad1-a580-1ea9cbea0396", "value": 6595072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773865587, "uuid": "e0cda111-51c7-49de-b129-e877ce994789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865587, "uuid": "f624cc08-19f7-4928-947d-958af42f1249", "value": "scvhost.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2575117-22dc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773846670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846670, "uuid": "eae7384f-89d3-4439-af9e-67eb4bda78e9", "comment": "Malware payload (ConnectWise)", "value": "1a46358b271ae4bdacac49a7c94b3406", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846670, "uuid": "443adb50-0d25-42d4-951b-fa6329de4834", "comment": "Malware payload (ConnectWise)", "value": "b230c94cb24dead0a67ea01ad641ce6df521bd747f3e1ae27c63ec5d6d92203e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846670, "uuid": "e7f2bcee-3fd9-42bb-a561-3533a47212ab", "comment": "Malware payload (ConnectWise)", "value": "d10a17efeba661da5128c64c65c2ef390a6d77dc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846670, "uuid": "7d1d6078-46ab-4c0b-a4e9-7d5e17d959a7", "comment": "Malware payload (ConnectWise)", "value": "5cf83208736c90ceddd5986a3c8af8579b338f689d4878b7eb4f4eb586bd84a35d7842559d54a58b56c1b08e153f470c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846670, "uuid": "76eb4437-c2cf-4fdb-b0b6-740a48b2a668", "value": "T166F633102BE8A5AAF2735B38EC7B26B00579BD51CE13D02F4319B81E5531D94AAB3773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846670, "uuid": "dd0163ad-d1ae-4968-9e7b-ee0a5d3ae842", "value": "393216:GOvTi7hha62a3N11WOvTi7hha62rOvTi7hha62wOvTi7hha62:GOvja371WOvjrOvjwOvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773846670, "uuid": "1003afd8-c759-460c-b6d1-c1d3e5429e40", "value": 16723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773846670, "uuid": "b3282e24-1c65-429e-8b48-8076c6a1eb74", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846670, "uuid": "ae800cdf-c0a4-470c-b433-8a9386e60f2f", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0efcb4-22a6-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773823386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823386, "uuid": "143a3c13-14ee-44a4-814a-5b512f5a88b3", "comment": "Malware payload (ACRStealer)", "value": "cc3ab78221e02d7d6409e8ef5f604242", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823386, "uuid": "f2a48273-8a51-40b0-acdb-9b69a15dba15", "comment": "Malware payload (ACRStealer)", "value": "b40047866ffef50dc21b4cc6b4f9643ebdc32f9f1584818489f6fa545368ab62", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823386, "uuid": "36c6301d-7a3b-4be0-8ad8-e70b5fec6cea", "comment": "Malware payload (ACRStealer)", "value": "cf4723ae97bacf4ba1b367eb31f933ddaddbd1e8", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823386, "uuid": "e5990539-afef-43ec-a0fc-5560ec31be24", "comment": "Malware payload (ACRStealer)", "value": "facd38fd8019dde02c078e901c2bf7c3ccae8d6fad6908502f538b3f5326303cbf6f7ceb0a1e57716166787c04159720", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823386, "uuid": "caa4099a-a730-4542-a21b-a3bbb2165379", "value": "T120653C0A80E658E3B5E314B74563A6427F390C4906DDCC09B1BE4DECB39AF9D63B71A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823386, "uuid": "553422cf-583b-4601-a32f-78a576c48db5", "value": "2560af07e8c46481887e984b59fb6d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823386, "uuid": "2d75c941-9b2a-47b5-b45e-74f7d6f40c1b", "value": "12288:TbQT9bKl+jx17h+6om3v983cr7J0xnRvkdBSz5wEk/YILFlQihA5oRLtBq:/yZ/ymwxnRyY9wEk/YILFlQihY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823386, "uuid": "2b660c64-9e0a-4542-a533-3cca6059e5aa", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823386, "uuid": "af70a70d-b4ea-4c92-b5e3-b37a4b1acbc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823386, "uuid": "24996d79-a3e7-46bf-a1f2-813d9834df69", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc028ec-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827090, "uuid": "0e887bdd-640e-49ea-b0e4-efdf0b96ec9e", "comment": "Malware payload (Formbook)", "value": "239241e875cf9bf06e727d5c4c6fb075", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827090, "uuid": "287284db-f8bd-444f-9bff-43baeb237899", "comment": "Malware payload (Formbook)", "value": "b4e421e232cd91356a089bed9c6c369101d612c991e0a1743c61f262452e6891", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827090, "uuid": "e13da1b2-e6bf-4509-bea4-5b5615d08c4f", "comment": "Malware payload (Formbook)", "value": "6f48d8932efd4ab44965b2c026f53e74f55e266b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827090, "uuid": "f7ac9116-9e52-4d01-a8ae-467bad4d5f6d", "comment": "Malware payload (Formbook)", "value": "db60aeb7bbe5d10bb18553edfebbc8e46b5de9675e8dd8e348ac3b2b3e53aa1ca70861f6598d676ed19c83366a076470", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827090, "uuid": "c39a210e-7daa-493d-b619-bbac0b91feb4", "value": "T155F312D01D896A6B88B8CB30B9812965CD767FFD6503FED3714CE50CE4DC1549B2B8A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827090, "uuid": "14ec27a8-3415-4ea1-acee-e80b31e33b2e", "value": "3072:FXStkA0s37HBJTR9l58QvziYzzTn00PJR6+J0s8Vkj0pjyiTXlsHK4lQSL/:AkA0sLbTR9rxziYHTn00PJ30s8MOdSHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827090, "uuid": "72dac759-954f-4ba0-af8f-01805d1844fd", "value": 160438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827090, "uuid": "fab212de-011f-40e5-b27a-b09a49f905a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827090, "uuid": "b28fd526-446d-4562-a767-fe110ba78d93", "value": "239241e875cf9bf06e727d5c4c6fb075.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e42168-22bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773832746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832746, "uuid": "40fc4b16-0a0c-4698-a072-ac0647ae01d7", "comment": "Malware payload (Gh0stRAT)", "value": "05f518982807fa4037bbd29fb068049a", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832746, "uuid": "c2094ed6-f923-47b2-a765-aa9743839550", "comment": "Malware payload (Gh0stRAT)", "value": "b533d1c8a7e56f703c78fb58f2327489cf3b4141e0d0305a9e1f636f886ab2da", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832746, "uuid": "829d680f-ac5c-40dc-907b-10dcfddd88e3", "comment": "Malware payload (Gh0stRAT)", "value": "2855ba9589a87dcdac9b10bc386fb06a0581ea5e", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832746, "uuid": "2ab9c2ca-f467-43e3-bd74-cd4ec0c11191", "comment": "Malware payload (Gh0stRAT)", "value": "77d9c66345d0e91c4ba65946e98b7e2b78e539b14ee206b5e30197fbf11c647ed597a235fa7ce3491ec6774fc649bcc2", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832746, "uuid": "1883cba8-6420-4c5c-ba15-3b135d72637e", "value": "T101473325E6DFC532D66E407AE925FE1C08B9BEB3473015D7B3E8B9AE84B08C15274742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832746, "uuid": "008288c9-3a59-4b6c-b86e-189eb2d96c97", "value": "393216:jXG+LqVJEVEzdWPTZFyRXyX64Jrx/BBk4aIEVmCa3Ur3Jxpp7uEY7fAERV3z2oPd:jngJuPkQ64TBu5VmCaAVp7uVLN2i5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773832746, "uuid": "10fe7dad-0b8a-4ac0-8c7e-6a420fc691f5", "value": 26039296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773832746, "uuid": "254124d9-bbfc-419b-b327-8475bf491fc8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832746, "uuid": "8688d9fb-30c0-47ef-a806-9cdd7a95e4e6", "value": "liulanSetup-1263.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d059435-22a4-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773822529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822529, "uuid": "47153e8f-1bd0-4fca-8c5c-cf2c0d91a187", "comment": "Malware payload (MassLogger)", "value": "1deb86e8f825976774180b08ef95cfb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822529, "uuid": "7043b951-3753-4f6c-bd23-e72ccea6b40f", "comment": "Malware payload (MassLogger)", "value": "b611335fe845cbd448a21b5592922ff6cfe567575c6d0b6da52ecd8ea6ae9954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822529, "uuid": "cda0300f-f223-4143-bcef-9bce2c987839", "comment": "Malware payload (MassLogger)", "value": "cdeed4adddc4da0656436e6a06bb57ac788cebc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822529, "uuid": "4f244fb6-9ad9-4bc3-8af3-07a6026d11d1", "comment": "Malware payload (MassLogger)", "value": "47de8d81c425fe0493ebf11a18d62382ab22b6e9ea7bd8df6a407ccf6c06fc16c85a452882913bf4871e2cfc0bd7177e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822529, "uuid": "f4bc40f5-7f6a-4552-ba19-91c071b60f12", "value": "T12A15E1046A48E802C5A59BFC1930F37446787D98AA11D707DEEEFDEB79386C274442AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822529, "uuid": "05150d5c-6a43-4520-8f7f-14d96ee7bd43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822529, "uuid": "b131c674-ee85-4855-beb8-99ab36402639", "value": "24576:wWEdFpdcvkI+ciafdxVarw2MD414vOaW4RY:0c+c5dVMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773822529, "uuid": "db0a0119-399d-4319-bf61-e642ee4f5944", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773822529, "uuid": "34b5d232-ba0a-4af8-ad65-4269bd00c4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822529, "uuid": "2319675c-800d-4479-b9c4-602859c3d832", "value": "SecuriteInfo.com.Win32.MalwareX-gen.25248173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d70250-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773827583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827583, "uuid": "70b48767-2df8-4db7-9645-f79982552d84", "comment": "Malware payload (ConnectWise)", "value": "5799b3eb56c08d87dc11b445b46f5999", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827583, "uuid": "40d88a13-5777-4561-ba96-5c42902d14c6", "comment": "Malware payload (ConnectWise)", "value": "b6e5ede61684a2246797a01a6b6aeb8f99603044abb8a23663da0395edf6f20a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827583, "uuid": "c53e292e-ac89-4f0c-98ec-245116edcd77", "comment": "Malware payload (ConnectWise)", "value": "b86c9a6c3880d2cd835e1967cf26d36729740cd6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827583, "uuid": "d73f733c-e178-4718-8bea-a1d018abaf13", "comment": "Malware payload (ConnectWise)", "value": "d2aa8f5dbf22003b8f7dc4f85356c8ffa161ffaf5e8ecf52cbc7e3dba2786292582aa7d81bc279fae1c994f729a8caf4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827583, "uuid": "49a3f812-f2b4-4144-a92a-43b226ca28cf", "value": "T159621EDCAFB6F01532FBD3D78AA29A114D1BBC0BB1157A8B1E4D0A14112D9C86E764F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827583, "uuid": "1ba5b42e-b7a6-4b06-a23d-3662d34215ae", "value": "192:MlxAt1rxGDnlNl/vHOeYYEYYoYYMLnGvFb3chDvUs0pFhLUcX:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827583, "uuid": "5b8756e9-83cc-4a12-8bfd-e5b4262e40aa", "value": 15017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827583, "uuid": "6b2f40e1-1bea-4dee-ae0a-0d560d63ec77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827583, "uuid": "f0c2ba64-30cf-4242-bcbe-391421f45da8", "value": "Information_file.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5df8c8-22ba-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773832089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832089, "uuid": "b6c8ad1d-0b90-4614-bc86-2d9ba2f314e3", "comment": "Malware payload (ValleyRAT)", "value": "08e73169f3a5523fde662796e41d5083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832089, "uuid": "299e510e-dff1-4e7b-abb3-7a44f451e3a3", "comment": "Malware payload (ValleyRAT)", "value": "b79dfe1cea021b73028eecbbe1909bae449352570c39dff32ecb8d1421d722f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832089, "uuid": "7e2a5364-6d6c-4be3-9ad3-171ac228663d", "comment": "Malware payload (ValleyRAT)", "value": "acc699220242180e99e5615a35012775777afb5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832089, "uuid": "2d52d3b5-f87e-4556-a6df-85fbe26a4e60", "comment": "Malware payload (ValleyRAT)", "value": "bfa3663da969d6ac3d36500e6acc6b1a0261207e8bec6c93f57a8fbd241072a6183620b9893b6c965da3fc3237191a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832089, "uuid": "7484a5ee-0f5c-49b1-b1c6-a439c4662707", "value": "T1A975335ECB2A20F0F5564179F3285D8C294CF87FC5474B9BB9DCB6AA2033085B5B9931", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832089, "uuid": "77802db4-91ad-4bc4-9856-7d5d8a602d1d", "value": "3557dad44152ea1cd59f57bd1470e8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832089, "uuid": "686924e5-874d-4419-a041-e093490f71fd", "value": "49152:AfwyXqlWbWyYAH+zxYTN0RVIAXqYy8PL0KwrtK:AfwJ2lYodpr3L2Dwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773832089, "uuid": "ec41d59c-91b4-4d19-80f9-12183c0b5fc0", "value": 1582592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773832089, "uuid": "44f9ce63-2530-42aa-8949-9597551bc88e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832089, "uuid": "43273074-20bd-4ce8-b255-5d13637f44bd", "value": "2026.03.17\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc800866-2311-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773869477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869477, "uuid": "639bbc57-8fa2-43cd-9ce3-a7dd4457963e", "comment": "Malware payload (Mirai)", "value": "ffd22a6b375f3a1dc5e2e628d12162d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869477, "uuid": "179a20a7-1761-44de-ab01-678f91b97888", "comment": "Malware payload (Mirai)", "value": "b83cd00cdf9fc087b32851e5a35739ea353a02d77068cd1f632563aaf1d10737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869477, "uuid": "6c3e5d95-8c83-4211-8032-8be47b1298d6", "comment": "Malware payload (Mirai)", "value": "4035efeded12742db6eac3e7df73ca92c6560966", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869477, "uuid": "84e3069c-b376-4255-ad2c-0ccead51602a", "comment": "Malware payload (Mirai)", "value": "24da1049bdfc937dea1776664f8b3939e5296393e19675ba6051e648a2a6e132ad6e1ff097d229fc07e394c34ed20a31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869477, "uuid": "d5d59054-c59b-410c-864c-1d65a6eb8e05", "value": "T14E83AE62C418AEA4C198567479B49FB98773E40092D33EF74AAAC67D5403EECF5093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869477, "uuid": "5cfbbf0d-06c7-4947-996e-79c9d1f4520b", "value": "1536:VAuJxAKHIncL/HwpQqaXq8vg+cpD3KmgNd+yQCYRcKvR12:VJelM4QNXqGg3p6mZyQFVpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773869477, "uuid": "d8bd5893-a1db-4520-b37a-1eee2947e020", "value": 84732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773869477, "uuid": "d389b6c7-410b-40fd-b571-04d20263f15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869477, "uuid": "291717be-ab16-4c1a-b12d-146601a5c455", "value": "tuxnokill.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dbbb24-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773828315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828315, "uuid": "b52e2b38-7844-40df-be6b-14cbf5beb0fc", "comment": "Malware payload (ConnectWise)", "value": "5deaa8a5e46e8880df8222177bcb7158", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828315, "uuid": "57375f0b-98fd-4d54-972e-dc1b6c8b1485", "comment": "Malware payload (ConnectWise)", "value": "b895abac5709358aad92fec5f99d25b3beaf81595719394f33f8f5fc46b331f3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828315, "uuid": "e330b58b-8c24-4ca5-bc58-cb99107e2caf", "comment": "Malware payload (ConnectWise)", "value": "c2a519c77f9a1849c372d08ece7c1c653dfb42d1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828315, "uuid": "5a0f7f7a-212d-49db-a92d-c63af3834478", "comment": "Malware payload (ConnectWise)", "value": "06d499f806fdd85bad6ade7599c8ce06930492e2e5f3d5d734ebe3a70029d8b5ab2ef6db9181d8f6592d00b8f828f163", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828315, "uuid": "82491034-769c-4c7d-a062-68869a2f4e5f", "value": "T1B3C16493738803EA9A541AED0158A02B54F6D469382E65CDEBF26707F43DAE1FC1C3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828315, "uuid": "3eb2371a-1580-4dc3-b4bb-eeddf560f87f", "value": "96:gvrkdrZz/26ZW3svEf1upj8RjqUjvOIryfR855Sfr8oAK9l868oRTkZYZcw:okBZzjZSsviMGNGSyfO55c8fKz97Rx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828315, "uuid": "172c63df-f638-412f-8767-b5c2318a123b", "value": 6123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828315, "uuid": "b46a9b8d-7cad-4e0b-8882-d343c5118251", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828315, "uuid": "936d265f-4428-456f-a9d8-93bd3afbd059", "value": "adobe_updated_27.092.3029.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e17df9-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801495, "uuid": "19146edd-8e63-43ca-b257-c7c60d50e411", "comment": "Malware payload (Mirai)", "value": "dc9a3186e0a88f67828108f4c02acfb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801495, "uuid": "ceb4214f-d403-4921-bf74-e046928b0451", "comment": "Malware payload (Mirai)", "value": "b8c7c536673e787f1bf7e190262ebed579254c881f3d102640d2339ea9a86296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801495, "uuid": "8f3e7b26-329d-4183-b0be-7982a5c724ff", "comment": "Malware payload (Mirai)", "value": "dfad353eb191af358e12ee105238914a52d0ac5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801495, "uuid": "e85d77bb-92c9-422c-8448-0525cebddf34", "comment": "Malware payload (Mirai)", "value": "ebfbffd656c558b300e4b85412810d061e1cbcd0f83662c635f0cb9d750889995bb24b5b67cc9da2ab5f237899f17597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801495, "uuid": "7a4017c7-f3c6-42b8-89d0-fca666bc4dea", "value": "T10A13F1BA5138C476D7348EF8C68A4267F47C1E99F3B9A355590434AB07A73D07082AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801495, "uuid": "895b1490-f95c-438f-8b9f-8bf539e835d3", "value": "768:975e8ZShliGG8+GvORa+/Yw+nFIVwGZI6ToK7OgbQVKLlpJolnL+TtC0xFIFQd9E:pSXomORa+gwkF+I6ToK7Ogk8ZLknLoC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801495, "uuid": "73ab0dd6-428e-400f-ae9d-634ca6a943b1", "value": 41960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801495, "uuid": "6d6660fb-5f27-4ce8-a05d-9b0c1ecd69d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801495, "uuid": "073f20bd-af78-4312-8a82-f27ecefdb14d", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24555728-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851586, "uuid": "8d1801b7-7c07-4dff-8e37-93e8a85d5416", "comment": "Malware payload", "value": "fa0eed6ef35261f43d8232c79d63a568", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851586, "uuid": "99cc968b-4204-441f-ab4d-a457ae285e16", "comment": "Malware payload", "value": "bb27afb023c1bdf97b24ea11b01e2487abee54d5df030a582fe9320f90b6446a", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851586, "uuid": "65c50295-8e5b-4f49-9633-fced27dab615", "comment": "Malware payload", "value": "18aef6412a0c1c8a19836361ee24820f80e54051", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851586, "uuid": "49a298f0-df4c-4c72-8104-7493f3848d91", "comment": "Malware payload", "value": "3e91c33d90e0f8d97ed43e14a38cec269f4d4cf0751e403df65961a405fa7472d96b37e4578ac3a25deb524ac1e877f2", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851586, "uuid": "40baacde-4b25-4da9-92af-93b859c62ad3", "value": "T1902523698D49FED94764862D10276F093570EF8600281AD436F48B9F2F3E718B217EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851586, "uuid": "39601dbd-38d8-4df9-bd08-4bd63799bfc9", "value": "24576:kIairze1g9kuV6uXKynn4dWt/Mpm9gmeKoa0:HLrZjP/tMatoa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851586, "uuid": "c697e1d5-c4e4-4459-848b-84d2aaf3c0db", "value": 1038540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851586, "uuid": "fdb9d849-9f96-4332-83f7-0d857ddfdb8e", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851586, "uuid": "65d80cdc-9df8-4095-a683-dbdcfbb080ce", "value": "1SPhMAR17_Hvvvvv.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40036d55-226b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773797945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797945, "uuid": "d501a474-c2d0-4159-9485-72887a9e48ca", "comment": "Malware payload", "value": "180dff8ac971f8f996289047e25ea814", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797945, "uuid": "81b59855-ea54-45d3-a0e4-4eefac2c3623", "comment": "Malware payload", "value": "bb4c7b6a16560499550612ae9d64eb56fbb19f06208a18cde2ff337a90779a78", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797945, "uuid": "348f86cc-0b20-4e5b-874b-466e73cd9c66", "comment": "Malware payload", "value": "6a276647d84cd9d7e1a178aea0cc738470a30980", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797945, "uuid": "0544630d-970b-4ef3-bc9a-e399b481d995", "comment": "Malware payload", "value": "4a4497d2661740fb7ea397b76a7525c6f7fbe3b68a64330ed60c3400ac93c7d09eabae10e485f039d4ea38071db65097", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797945, "uuid": "bc2df63b-3fe4-4117-b0be-1c4858b0f7ef", "value": "T12DA352865F8F45E586A9F42646AFEC03DEE4D652121CE09B3B1FC805FF1666843BC6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797945, "uuid": "f2eebec8-90f8-4675-851d-0851a06465fd", "value": "3072:pG3PtFdtL4T3NgqDua/ox8oyDL9wMHCvlRgf9Wm:4RgFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773797945, "uuid": "0c18b907-083c-4155-97f5-78cbd5e7f64b", "value": 107314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773797945, "uuid": "6cc0588e-d3d1-4db6-88de-1005ef5697f1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797945, "uuid": "62f3eefc-d03d-44fc-b606-6db50efac0f8", "value": "Photos_Office__64.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55e0f8a-227b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773805094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805094, "uuid": "0e8118df-d059-469e-98a3-cd9b1a48e5c7", "comment": "Malware payload (Gafgyt)", "value": "f9310544ec2f3588bb50d3eff75e94d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805094, "uuid": "651b8566-3de3-4f23-b46d-7169775e1716", "comment": "Malware payload (Gafgyt)", "value": "bd8d18a7cc1f3ab95ce1c91658e99bb2a4f08a83231887f0d9bc85ca4e3e7075", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805094, "uuid": "54186e5d-d852-403d-a3ed-3ff2d645aafc", "comment": "Malware payload (Gafgyt)", "value": "146e1435ede09ff636af83a516a8a67f63f5f2f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805094, "uuid": "1019057e-0778-4238-8bc4-ff73556f9d40", "comment": "Malware payload (Gafgyt)", "value": "e1da9f6ea4de0be6c1398348d47bddbe2be0bfeef3165b5652f2bb14178306e34584e08ff54927f72d71e833935b43ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805094, "uuid": "1fd7edef-6f3e-4232-bb35-35954fdcc33d", "value": "T1DA74090A6F911EF7D82BCE3742A90A4A30CC645762953B3A3574D624BE1F90F59E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805094, "uuid": "390870b6-a1ae-4307-84cc-f91537dd6df9", "value": "6144:m6EZvrwg6gndCBbQrUPv3hzZq4VnMLYn:hJIY/J9npn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773805094, "uuid": "e13b5d3e-52a4-4934-811a-e71cb02697e8", "value": 356768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773805094, "uuid": "21fb5744-1eeb-48ae-a993-495704b85db9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805094, "uuid": "53df581d-c341-41dd-aee9-f5fe1be97183", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69efc443-22e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773849126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849126, "uuid": "7c75bd8d-2fcb-4a9d-8ed1-7cf8902edf71", "comment": "Malware payload", "value": "950ccf81218366be901cb699248f3f56", "object_relation": "md5", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849126, "uuid": "536a59a8-e06b-48b9-b76f-eaeb88655a2d", "comment": "Malware payload", "value": "bef28b9b32342bb5a2824b7cac4a063ec98cd8ddcdb7ed5251add765dcf62160", "object_relation": "sha256", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849126, "uuid": "a27ef125-b725-45a7-8225-86acbbf273bd", "comment": "Malware payload", "value": "02765e6352c05c79d61057c75af59ef36d76eea0", "object_relation": "sha1", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849126, "uuid": "7889b0e8-ce13-49ad-bc45-47b2cbc9b103", "comment": "Malware payload", "value": "23ea3710d08b3fc6c9608b6b71a2d482f1a5c8c4b3fdca16ff74e1dbb413d4c5504496ee13dd5a74fbfc67cfad723f33", "object_relation": "sha3-384", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849126, "uuid": "cbd89582-fa2c-4450-8a88-c7be009e3c01", "value": "T1AD3623D049D69A3E091CB238602B6F3FDBE2ED3C558C75C59B40F446AEEBF18466AD10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849126, "uuid": "c4384416-17bc-4cf9-a7d7-f5fec98d90a7", "value": "49152:F1hdthNashY49rlVuzBMJNqkr/fXOqu2d8im1sBb9geBAUUfNzhE0xLQPIDlO3XN:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773849126, "uuid": "2f5c539b-657d-47ed-9cce-5294c2780341", "value": 5119455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773849126, "uuid": "02f30d12-56c9-45ad-ba30-b3e2288f2f0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849126, "uuid": "83f74eb4-9131-4bab-85e0-d5de3b9b3732", "value": "bef28b9b32342bb5a2824b7cac4a063ec98cd8ddcdb7ed5251add765dcf62160.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b6d92c-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827568, "uuid": "0938d95d-6169-42b8-a50a-fd86b3d0e6cf", "comment": "Malware payload (Formbook)", "value": "91e4986997e862b63a808c8f8dd1f394", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827568, "uuid": "441331ef-4272-4a49-a107-9549e379f9dc", "comment": "Malware payload (Formbook)", "value": "bfbc2499cd2959f37f008b16450bd13a32025dcd81ececca0ca27a5f8b083ce2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827568, "uuid": "424df9d2-ee26-4338-8ca4-25b8cfd74ad8", "comment": "Malware payload (Formbook)", "value": "c1b7c9cd81f95a58c1decbb11e16b003015177b4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827568, "uuid": "fcdb8bc8-2dc1-4e41-bc1b-ea9e484fe8a9", "comment": "Malware payload (Formbook)", "value": "57547ea22113375566fff8ba6f0c0011e5f436859c91045b5c88171c6f79b678d533315837d2773a31dbb9258bb88b1a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827568, "uuid": "2d51576c-43a1-4db4-85df-7873dd303f0c", "value": "T1FA858ABEEF6C39DF9C963AC172460455E417891406F27DA02FEAEDCD473CB620892AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827568, "uuid": "b8c1dc41-dd25-4e5b-a1cd-e0e1b09bb7a8", "value": "384:3i57LTBCOtizq2fhuopb/AJGYOxrc11I2u2XyAKng4D/2nS/vClwLno4D/2nSiTl:AEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827568, "uuid": "035569a2-7607-4e33-bb1b-33e80d7c59da", "value": 1863324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827568, "uuid": "e6379728-780b-4d81-ace1-54bd222b7271", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827568, "uuid": "0285f3a4-ce30-4c23-b1b8-b731eb48888a", "value": "91e4986997e862b63a808c8f8dd1f394.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1632ca-22d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773844249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844249, "uuid": "63787940-f863-4dfd-9e28-12d1d0b70151", "comment": "Malware payload (Formbook)", "value": "f32b5fe9a2adbf13c7ee6691df762324", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844249, "uuid": "c4c52175-62ee-4d91-8f7f-30d987f570e2", "comment": "Malware payload (Formbook)", "value": "c03209d718c5f7ab162d3ed3ea41002edc2ced4e9b0f74d11d092bae7adf4998", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844249, "uuid": "f0e9650b-416e-4218-818c-672f323e0371", "comment": "Malware payload (Formbook)", "value": "5000204dd3d30a850ba7e9d0a76c49a08fe860d2", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844249, "uuid": "ef39e866-e385-4ba4-a6f8-0a6b6dcc8ce1", "comment": "Malware payload (Formbook)", "value": "f30663419fdf7beef0cfaa8e01d7fb7529d09372e8f3fe029601e28494ec8abf24b14e37a2261afedd06d7b838f97a61", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844249, "uuid": "829dab4e-2e29-4d74-a99d-068e65f5b519", "value": "T1DB5412784D32F1BDFF5B82BC2E21A39EC66CBC9C5834AB17C25B56885F52B121617438", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844249, "uuid": "b5c09e71-7a97-4833-a0f5-b43bfebf7710", "value": "6144:HmgKOX/zSMauHffqCLbShIBAqpreqBDlshzWEn1Q/NsdMcbD50M17f4Mek3x:HRX/zSMRfqGShCreqZ6hzWEa/N2MGl/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844249, "uuid": "de2cb3b1-a330-4116-b0d9-ab12bea5e074", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844249, "uuid": "ec071378-1ac0-4d3c-beee-68f0c5ef1b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844249, "uuid": "346dda1b-e924-48b1-9c4d-23c1a66b248e", "value": "bin.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fbbce3-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806819, "uuid": "2625a34f-ab2c-4e55-9f58-7f38169b5343", "comment": "Malware payload (Mirai)", "value": "26fdc113cd46767e6fdc2dac14ad5508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806819, "uuid": "dc8a4b3b-448a-4427-b643-c412211a3b6d", "comment": "Malware payload (Mirai)", "value": "c04d526eb0f7c7660a19871d1675383c8eaf5336651b255c15f4da4708835eb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806819, "uuid": "3af8601f-2f53-4ebc-9618-8cf8747c092b", "comment": "Malware payload (Mirai)", "value": "37a01fff36a7d117522b5f6e97da2b749ceb9da3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806819, "uuid": "7dbe50ed-e40f-41c6-825f-80bfd28e2e93", "comment": "Malware payload (Mirai)", "value": "40fe1cdb2da65838c09be838adabe89f0fff244013ba73e34bb51e4ac064fd7dfa27beafdd71e02dca1bc1e679aab922", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806819, "uuid": "ca071bc0-1b1a-45ce-a43b-487a459acbd8", "value": "T141E33B80EA53D4F0D8420C715066B737EA32BA7E503BDB83EFA56931ACA6702D525F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806819, "uuid": "bcbc43ad-1f7a-49e9-be2a-c456fc41d83e", "value": "3072:q5tBJEReZiMzcaj9U2KywYPWIL17ZCi5Lj:q5tBJEcZi2caj9uSR5Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806819, "uuid": "86bfd5ea-8cec-42c9-9b08-cfe0675fefc8", "value": 148104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806819, "uuid": "2b6a36c1-dacb-4d5a-8bc3-b7bd80abc6ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806819, "uuid": "238e96e2-4c73-455f-8870-2bbd2ac0127e", "value": "nuclear.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9c35cd-22a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773822560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822560, "uuid": "8cb8e6d5-49fc-4759-8466-7add6c8aa68e", "comment": "Malware payload", "value": "6caa4b1cd2b68e2e17970178b9e32b6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822560, "uuid": "2efeab21-be77-453a-9b1f-94bdb671d138", "comment": "Malware payload", "value": "c0c4f203836523475eccfdb134a7aeb4b2a9db84031cfa3c1c6c197901075c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822560, "uuid": "61a1f1ea-db66-44fd-83de-98f14e9159fd", "comment": "Malware payload", "value": "dfd77266d9d41edfc380b2156580435c9fc88e4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773822560, "uuid": "089d4df0-fea8-45ae-b0ee-89cfc9ccb8f8", "comment": "Malware payload", "value": "593031f1370c1d837c7af40b29c96658a7fa4d98866b147b5d717e27bf1154a4720a507175cbc7a4cbf2d10ed992d3b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822560, "uuid": "37203049-8eb6-4081-937f-e77153397167", "value": "T1E6865907EC5545E9C9E9D6308A669122BBB27C495B3023C73B60F7283F77BD06AB9350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822560, "uuid": "97646780-3c26-4e16-acc5-be4d22bf1178", "value": "49152:jlYrSX49H78OM6vZ+uAO9wBnWERd3elXUFTq2+OHOEVBSkaIAnstfubyg9SINloH:jGD7w7d3ehCTqMwTHd9nlU/BMZOKbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773822560, "uuid": "888b0f2a-c1fc-4416-a92e-5dd704936031", "value": 8468520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773822560, "uuid": "6e8f5156-e905-4bc2-b4de-48bce7e7bfff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773822560, "uuid": "03043b8e-5854-433c-8364-ea637b07e5b3", "value": "ethd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63430c7e-2315-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773871019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871019, "uuid": "a20b07cb-c2cc-410c-b8b0-32414d442741", "comment": "Malware payload (Mirai)", "value": "7b0f5bff500ca18dc77af8d9021105f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871019, "uuid": "22902cae-3cde-401f-a362-63b382d29e4a", "comment": "Malware payload (Mirai)", "value": "c0ed0011fcf308e1216912d20f1b8de270c4226014f030de983974fc4d93bcd4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871019, "uuid": "ff059392-24a9-4b38-9034-478e461806d1", "comment": "Malware payload (Mirai)", "value": "e5ec754a141b7ab425b33c98da68d5b9c385f723", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773871019, "uuid": "4373b4d9-c25e-4f00-a0a9-5c96ae7d3bfa", "comment": "Malware payload (Mirai)", "value": "4694365ed84123884e4257302dc7c3328d4f618f692bdfbded25df623bc10bf8c2936273ab57a2f42eb5004fb83d6002", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871019, "uuid": "6a88f033-f785-45b8-b205-b06b40c4cebc", "value": "T163418F4D30517BF47C786B2F79BAC89831DAA8B648D7AE5710ED34FD80AED1458602F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871019, "uuid": "2f1c8dc6-8dcb-4b8f-9768-33561c7df7f7", "value": "48:b9Ip9Kp9PL+p9kp96p9Wp9Kp9ap9Wp9Ep9wp9yp9ep9A:2e/+4eKu+6oUGiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773871019, "uuid": "68db8493-e190-4931-805a-44d1becdd13b", "value": 2169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773871019, "uuid": "ea2a8b76-28ab-4ab5-a943-6667d5f245a7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773871019, "uuid": "5bc39a02-544d-4ea2-94c7-660b88d81112", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d142fa0e-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773825247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825247, "uuid": "47a77e3a-ac67-4a35-9962-6cad7496734e", "comment": "Malware payload (Vidar)", "value": "752aebe52b860c44d87e7055cd7cb309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825247, "uuid": "38c6b4db-f82c-4e8f-961a-feaa5f571184", "comment": "Malware payload (Vidar)", "value": "c10677bbad5444a52cd99ff0e239400375eaf7720866e6828efdfce9d0703180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825247, "uuid": "401164fe-3faa-439d-9c2c-83752d9cd31f", "comment": "Malware payload (Vidar)", "value": "e92f14ec7846bab88011723a3cf0a564d2aa6bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825247, "uuid": "44bb15cf-a366-422f-abaf-488d685cb3d3", "comment": "Malware payload (Vidar)", "value": "8a2b0eca15b18a80517dd44cffe9d86d33bd23d1268e926c6ee3269b8f7db624916bb346b1a370d71fa2822ab6d76413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825247, "uuid": "3002371c-2a70-41d2-a1b0-abec36e1f497", "value": "T178A58D56BCD104BAD0AA9736C9B291967A75FC0E0B3233D32E506B783F7A7D09938750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825247, "uuid": "7058ad97-9aa7-4114-8284-4a88791fa289", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825247, "uuid": "e9d602d2-33a2-41b8-ab9a-440debe88366", "value": "49152:PdnA9cY0MGH8owBneRJrC4uhBX5Ve/G2rN6WNqEMA/wKJqhsxhSJ:P5BHqEMQJ6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825247, "uuid": "e2c0056b-8822-401e-b98f-2da460301d2c", "value": 2063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825247, "uuid": "d9727df5-aa11-4fd1-8fcd-750623e074b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825247, "uuid": "8b42b2ce-84ae-4f56-98aa-596d36db02a2", "value": "752aebe52b860c44d87e7055cd7cb309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e24658b-22a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773823631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823631, "uuid": "27fc57fe-932e-4c71-bf86-c79b8c4e68ce", "comment": "Malware payload", "value": "aaeed76038bcd4e31e7f7f1dd74b9cde", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823631, "uuid": "c472a49d-a141-4a5d-8ac8-281a42b4adb1", "comment": "Malware payload", "value": "c16f53a9880deb31269956a7290ea4ae8c87b0cc36383af4194c8eaf33f1939c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823631, "uuid": "5fed3a96-904a-4ce0-9ce6-7e29c9527f2c", "comment": "Malware payload", "value": "86a2e7032ca936bc83258faac2a9b337414faddf", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823631, "uuid": "ea32dc5e-f84a-4d1b-b6ea-f54821d2a31d", "comment": "Malware payload", "value": "a4fff9f057da09de000efaf69e6ac994d92bb8a3be8a317a210649e9cbc5bc96b031f8b892f2018d977d22b4c8542fab", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823631, "uuid": "5001f06f-dc30-4207-a97f-e45ebfba3c1a", "value": "T16BE02B21030B620F486EC182880890CBBA9CD2C803253AF248CAEC2089822E99A8E219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823631, "uuid": "3e5e677f-1cb3-4e47-a159-967d465e310c", "value": "12:wbYVJ4JFhN3IA984CXLgyaIS1PKC2ALFyGHDfhy1MnG9k1N:wq4jhN5EXLw1PKC2kFHDT5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823631, "uuid": "22c6861b-7cbd-46e6-ad2e-a57f606b97cc", "value": 427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823631, "uuid": "50546755-7580-4320-aaa8-90ef73112932", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823631, "uuid": "aeaeeb2c-b252-48af-a891-4e2406c8d260", "value": "interac.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6191ec-22e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773849992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849992, "uuid": "55d62241-670a-417e-94c9-c475c7bb960d", "comment": "Malware payload", "value": "8f0f6c41954c4ffa44d3b1e9af75e611", "object_relation": "md5", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849992, "uuid": "dd63d51a-b911-4e38-ae3d-c2ebd1b25bbf", "comment": "Malware payload", "value": "c1ed2509ee2c06878d4e9e7da7a5ba4fe095dd970c213c84fd6a5b90c29cbf70", "object_relation": "sha256", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849992, "uuid": "9c1b3fa4-1955-49a9-88c4-75dfa172f5ad", "comment": "Malware payload", "value": "2cbb5ea98ebc97a048f9c9d188b303be6c424a1e", "object_relation": "sha1", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849992, "uuid": "7202fed9-93c6-4fc2-a2d5-9e943aee8faf", "comment": "Malware payload", "value": "6d3995d74d935446dc9bfef4c669aca3ae0cc0815ea56df49b48959fdae57073e222dadc53ee2093cdd62737487df7f2", "object_relation": "sha3-384", "Tag": [ { "name": "captcha-verification-module-com", "colour": "#3A1848", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849992, "uuid": "bcd0f33d-17f7-4869-9cac-df36ed6103a5", "value": "T1F4432906A1A131BCC05E803046575F23A5BA7C0855736CF70BA1FE793FF5528A27AB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849992, "uuid": "908e5d0f-e65e-4c0d-afa0-965064d01896", "value": "20950c93f21e57e75716f301cc245775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849992, "uuid": "904ce4d3-752f-42bc-96a3-af141eb6e711", "value": "1536:cgs5VW8P5SzyRUjD61egrg1QGUvwvCCw+0XPH6UISDOJ:cgY7P5S2PXPH6UyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773849992, "uuid": "bc0522f1-845f-4c45-b3ef-e99734ec9f1d", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773849992, "uuid": "db6f282e-8900-45fc-818b-aaeac6773a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849992, "uuid": "973afd03-a22f-45ca-80a2-bbfb4f83e717", "value": "OLEACC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df598ac7-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773828277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828277, "uuid": "5ab23a30-c195-4c9f-99a8-58861947e2fc", "comment": "Malware payload (AgentTesla)", "value": "a494222aa4efbcdf7b15dc80df03d79f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828277, "uuid": "3eb1e69b-daec-4519-8411-749bb51c8071", "comment": "Malware payload (AgentTesla)", "value": "c212046a7c9d0b1427392d843c97f633a361b054105cb32ff7ff1186c05b72cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828277, "uuid": "fec7e90e-507a-4dff-97bb-e342f6d764ca", "comment": "Malware payload (AgentTesla)", "value": "01e17c119910f8b21f249ff22d5fd8761ecff17f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828277, "uuid": "0dfcc55c-cc4c-49dd-aaff-ab19aa4b7945", "comment": "Malware payload (AgentTesla)", "value": "eec016437ef7a0c3385953cb3d4b641be922779de7c77a5c6825f182c33df77a151e561df8d170a2159e1ffe3e7766c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828277, "uuid": "4a37abbd-15c3-4874-9971-e146d250fd8a", "value": "T1B9450A15A533FE944EE6375A920F7CFAB87C307A3167E88D2E7712ED5C93812016D886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828277, "uuid": "bda1fa4f-74b6-441b-9ca8-555c5ca002c2", "value": "384:o+EPflPKeMmqY032473zAoMB19XBgkDvZOZejAkasHBBh2fDpru:I2rpru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828277, "uuid": "b3b8424b-94d3-45ee-8005-342b2fc95531", "value": 1227647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828277, "uuid": "19f86128-9192-48f2-865d-b4f27ac634cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828277, "uuid": "3ba708f8-7ecf-4ce7-b80e-ef60bd3faaec", "value": "a494222aa4efbcdf7b15dc80df03d79f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22ae35c-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827423, "uuid": "61427bc7-4ef3-484a-995f-14b6649167df", "comment": "Malware payload (Formbook)", "value": "9520868660cf25b8ce0dde43c24c6baf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827423, "uuid": "8a58514c-0d77-4919-95e2-e6755a708ddf", "comment": "Malware payload (Formbook)", "value": "c2a2d03ed6c69edeb3d1241038618a8d23ea1a4389b8cd13e32d78fb38e84a89", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827423, "uuid": "48057647-36cc-4a69-bf6b-fb4cb8ee8637", "comment": "Malware payload (Formbook)", "value": "ad66c5a19af84ef99b0ba8033bb532e0dfd5a4e9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827423, "uuid": "fba47760-2d3b-4e2f-85c3-f493b1d110b9", "comment": "Malware payload (Formbook)", "value": "9a7135ae61766c6c87bfc932d7efd6441d893f42329a7d44b0da9d92bb8d576ac98a2e93613d233c60c5b2fc1dc3df62", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827423, "uuid": "e6c378b4-6d6c-4293-bcdc-647b9f81d95f", "value": "T1158502B6E7CD1CBBBD6076D798C135D4CE7796AE15E1393042208475ACAE7823AF02E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827423, "uuid": "84e32bfe-27a3-4cf1-9cff-c1dbbb72a106", "value": "768:r+zWEJHo3CVZ4RGs5O8R9vXUB1vWrR+vJqt6kpMwJVppJlXp3B6Dkud6dJQDlXp1:j/8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827423, "uuid": "1762211c-468b-4247-b3dd-38b545959713", "value": 1739844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827423, "uuid": "69d02152-1543-467e-8d6b-3963ab5b5dd7", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827423, "uuid": "f6692eba-22b3-421e-b319-c71adeeb8903", "value": "9520868660cf25b8ce0dde43c24c6baf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d8d18a-22d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773844471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844471, "uuid": "cff7cfdf-e8e1-4f3d-a845-7cda1706ab7f", "comment": "Malware payload", "value": "e301f4ac7b04517a13283cbe1b22201e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844471, "uuid": "820ec9a7-617a-4635-8687-d2087668fbc1", "comment": "Malware payload", "value": "c3317c096a1e59676dd28dde28854fa40ebd18eacfbd2c07fe2c80ca312bbe68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844471, "uuid": "99231e90-855e-4f8f-b0fe-c35654f42cbc", "comment": "Malware payload", "value": "cd0269b7677f9e62e8c0eb36da2525f09d1189f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844471, "uuid": "fdd3b91f-3a0a-4f51-ba8d-8c21042b23f2", "comment": "Malware payload", "value": "6053ab61c4608e4cbd4503119561e38e8d2855deb08a168c06f30968e051da93c42a6ac020c3dabc9b2aba21a82887db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844471, "uuid": "0143cae4-bad8-4078-979c-d5df757ab8a3", "value": "T1DC263A47F851C5B9C0AEE130C666D292BA317C885B3123D32B50FBB92B76BD46E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844471, "uuid": "e85be057-90e6-4978-bb4b-f76916988e81", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844471, "uuid": "528f76ed-8324-4adc-903c-b1c33ce66c20", "value": "49152:sBoe513k8CMgnrb/TMvO90dL3BmAFd4A64nsfJNWlviBqJQRUczubf0p6d5EPxgu:Q3kRpynfYuXE37IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844471, "uuid": "4b9da698-e455-412e-b354-ed92e4da0537", "value": 4523008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844471, "uuid": "b4ee81b2-90e5-4523-9885-2573cee56342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844471, "uuid": "36cf063b-2e6c-4556-a454-d6f463872d90", "value": "e896520a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd65d0ca-22c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773835629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773835629, "uuid": "1b408b14-855f-4809-9df5-2e584f5937f5", "comment": "Malware payload", "value": "0d0ef17e86a2bcfb97763c54731179a5", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773835629, "uuid": "a1f49e82-9b9f-493a-8380-3d5de0af5ef5", "comment": "Malware payload", "value": "c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773835629, "uuid": "b3376178-6fbf-42f9-a333-a233a8a60325", "comment": "Malware payload", "value": "73d4b0ace1a8c63d03c5cd502215ebd7f27fc03e", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773835629, "uuid": "b3721202-6f2e-440d-9b66-9291e172b8a4", "comment": "Malware payload", "value": "0e4571a1a1a32b40ea3a2e55f858423dedc8ab783f2764cf6dbfacf82e751c4eae873d3e2ca77a7115aece735d510704", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773835629, "uuid": "5bdf022b-5a8a-4eb4-8030-d5c395126780", "value": "T154763369E97A0F35FCD443F357F12C09D20A65282BA8A84E83D13CBE8E51F34AD1961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773835629, "uuid": "5b985784-2a9b-4cbb-b7d8-e291cdc7e11d", "value": "196608:V95eESdQSka+5KnHSWzRQ0u0o9fA3Zna2NhvfsY:VKQfYHSWVw9oJdvkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773835629, "uuid": "e77c588c-2cb6-48cf-ac8f-ef493ba952ef", "value": 7577910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773835629, "uuid": "8ad6268c-9bb6-46d9-9044-33290211fadf", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773835629, "uuid": "1b3d2b0e-6cd5-47c1-b271-f19f5573f98e", "value": "CV - 585126.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f9381a-22a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773823168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823168, "uuid": "23943ba5-dc05-4eb1-8d1c-d159fdd2cd2b", "comment": "Malware payload", "value": "6fb783c2005777d1e66377bb5db8f6dc", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823168, "uuid": "02af4cd3-2fdd-4cbf-a79c-582811fbe69d", "comment": "Malware payload", "value": "c511fc7f9049646a189c0989e1b355fb29adf4fd476e284e47f04d660a60c324", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823168, "uuid": "286bb7a3-2d79-45c2-801b-19ff723b4c15", "comment": "Malware payload", "value": "a542e6e2675364686e7eb7da0548fff26671ea7c", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823168, "uuid": "5c1b718e-bacb-4a35-8cfc-7fbc8999e213", "comment": "Malware payload", "value": "2d8700a6ab0abd050c1dc69346321e7157cfdd1b81823c54ff7545b0cddb7eb577f3031100498328c8d67add76d08481", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823168, "uuid": "f8d3d51d-f35b-47a3-adb6-2f4a79634ee6", "value": "T148C3CC0E24FF81460BB324A985575883DDAA8A0A3449C91E3A1DBF11EF095ACD3FD7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823168, "uuid": "4952cbf7-6b0f-4797-b67e-ade6dde287cb", "value": "1536:1HcaiJFdNvlAII3ds6213S8MnhSNHf/3pQO:o7t1Its/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823168, "uuid": "13f0ab2d-7a66-41b5-8e96-53741049b65c", "value": 118500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823168, "uuid": "36253cf7-5734-4138-b306-d1d69f0f07b4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823168, "uuid": "f88b2ea0-6576-41d4-a272-ca238f576358", "value": "Z_Template_London_7218.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03491486-22c8-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773837786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837786, "uuid": "d7d78a71-3ccd-4950-af16-f6242e88c771", "comment": "Malware payload (PhantomStealer)", "value": "ad5bcb01cc585077ff8f2107257377b5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837786, "uuid": "03121d26-ec45-47d8-84b9-94a195e980d4", "comment": "Malware payload (PhantomStealer)", "value": "c5830b1e211c745c7b6bfe70b95b1145a799b71409039f671c51bf425e4bfab3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837786, "uuid": "b3e1d0ba-f19b-4efa-a9f3-aabe3d9b7236", "comment": "Malware payload (PhantomStealer)", "value": "147efea33e90f789ddb3eb40bc3dc5cd1334c5f2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773837786, "uuid": "ce82b554-c5f3-490d-be25-9ffb5759274c", "comment": "Malware payload (PhantomStealer)", "value": "9ccf4d0ab8c425e99bcfb965ae83eceaff4a44c4e10a76b277939a5792203e5543ee6475a7e729a8c595041bdd61b5c8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837786, "uuid": "69b94de9-60fc-4c7f-ab4d-d590b339bd1f", "value": "T154350215C9C81FB9DFAC5A1980FE160E67E04A8E556BB48EEB33BE46AFE7500410B1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837786, "uuid": "c6287657-a69c-40fc-a4d6-7e6209486d8e", "value": "24576:RiaGvVhMB74dF5V1R411tGX21h0Gh/4MDaFJ6:GAqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773837786, "uuid": "4bd5f9e7-2059-44ab-8d00-a22220bd4715", "value": 1126279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773837786, "uuid": "edb473d1-69a8-479a-b5cb-4f89c1a1c23f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773837786, "uuid": "143c7745-ead3-4848-838b-0126a60504ac", "value": "Enquiry AMJITH Rfq 17.03.2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4986032-22e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773848365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848365, "uuid": "e32bf052-03e8-4043-a05e-72b66923f808", "comment": "Malware payload", "value": "4ef203ea548ee7b066c4cec87436aac8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848365, "uuid": "08ba3f51-ed4d-4c87-8ee1-7d74c0739f94", "comment": "Malware payload", "value": "c6b8ec482a3f91f40f4281bdfaae026de6e14b3f3d0de58fcd7c1369a41d2820", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848365, "uuid": "1594161f-6f86-4769-9a5a-3561e7bf7b3a", "comment": "Malware payload", "value": "50eb79e516dc3fd1cbf20b7e3e1438c16232ec97", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848365, "uuid": "e5883b26-ddef-4013-9305-6e8921da2001", "comment": "Malware payload", "value": "122c6e94546b461c06516c7429506b261a61b7de0b54ceaa3be3bcb180ef5585e492ec7f480f04ddb84fc19ce793fc09", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848365, "uuid": "0fa2ae49-8b34-4e41-aa21-98f813d83db1", "value": "T19F652362FE40DB5CE40EC2B067C2CAA6362CFC317B54A5437E0DB35B7876AA4A543761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848365, "uuid": "5c7866b9-d393-487b-ae36-49c8983745f5", "value": "24576:jKvn/6YyOkz//sMRNYKjs1BBK+Riual2p8WnotDb5ENJ:e/QOO//L5yBguhhotaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773848365, "uuid": "cbff6e04-6148-4fde-91ce-5a071149cb65", "value": 1422848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773848365, "uuid": "a6a7dbc4-1254-4885-89f0-d93360ef4cd5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848365, "uuid": "c1448909-5d0a-4ec1-ac49-ccbd46c40e3b", "value": "JSW_STEEL.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f172f780-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827019, "uuid": "9689ccbf-da25-4499-bc34-6a6b5a058800", "comment": "Malware payload (PhantomStealer)", "value": "7958a775c02ba551dd7a84c30a0669ef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827019, "uuid": "7e88541e-68a3-4635-b9bd-efab71f25a75", "comment": "Malware payload (PhantomStealer)", "value": "c786eb77b4ffd17617701a0fda22dfc202411964fe17faf74da2f8e00c1ce182", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827019, "uuid": "1ed9dc9e-3816-4dd9-a207-062f746f6744", "comment": "Malware payload (PhantomStealer)", "value": "fe90fd7d8c44c37f995e7520c48aad92faae3785", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827019, "uuid": "8c45201a-f133-4899-9a46-335d02794681", "comment": "Malware payload (PhantomStealer)", "value": "007258e4090898bdb361285cfde9770db355a03c9618d7ab60483b7c0dfb7fd5d29f826b0e6bed93dc162e95c19fcbb9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827019, "uuid": "f29198b6-8bbb-43cf-b7bc-f6fd1682d42b", "value": "T1855366686FFC066B1F940B69F80CED61096AC55B01930856CE49BFFF8C5DB368D2B5A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827019, "uuid": "f5db0297-2d42-4b94-ab22-397b8b1e154a", "value": "768:PrGh9gIQ8LXbc7hL5H8CLnrbEG+cxIlKc10y4ryNJLW9rnoclWAVh9wWyahs+dC:0wLvxe6rsJL4UAhldC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827019, "uuid": "fd55bdac-00af-481f-8c05-42fead270de7", "value": 62327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827019, "uuid": "784a4f66-7c19-47b9-82f1-9ef1796a2963", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827019, "uuid": "e19a80f3-840f-401d-95c2-03fa8569f18c", "value": "7958a775c02ba551dd7a84c30a0669ef.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36df6c20-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827136, "uuid": "13839f2e-5374-4cfc-bca3-e456cae625db", "comment": "Malware payload (PhantomStealer)", "value": "cbce3d842620de62ab1085cb03981443", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827136, "uuid": "7aa3cb0b-7164-4ece-af9d-1b8cf724a367", "comment": "Malware payload (PhantomStealer)", "value": "c992f37ad31b9a7f84ac60c837646e5f22434cb2d04e0216a7ed1e7229624c1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827136, "uuid": "97475dc7-22a2-4c81-9d88-e89d5f4cd0ea", "comment": "Malware payload (PhantomStealer)", "value": "113a721656d91414e63650e8a786e51ca9a01047", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827136, "uuid": "9083b99e-2d22-41ab-8439-49adc2fbd810", "comment": "Malware payload (PhantomStealer)", "value": "8ba65440a70a17c7f5ce0db2fe176fd12cc076beed577da154636513ab72542132eb394a2b68f8afe78eb52ae714dcaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827136, "uuid": "4cf7a7e5-dbe0-41a7-aa45-b3be13da463e", "value": "T1C626BF6A3688F3F48FEE7B45815C458F0773999B6862FA0C9906B3195F73B105B0E90E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827136, "uuid": "53210080-26fa-4253-8561-58961e6265b2", "value": "24576:1feeDm3KaIgJ3s4ogcppNySALQ3LHBNf4iFq3g3F8xzhCHgmXFvdnLSa6+wGISAo:EUg7QpJgK43hsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827136, "uuid": "e71c5bf6-f64f-4f50-8e44-b037db510fab", "value": 4662150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827136, "uuid": "9277cf90-a964-4a91-aaa3-3f52759c4eff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827136, "uuid": "24d3020d-c667-4f2a-b010-cfee4622e90a", "value": "RFQ TP90012.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40bfcd1-22d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773842432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842432, "uuid": "57619564-d45d-4abe-85a4-4d4ce3f0d2d1", "comment": "Malware payload", "value": "b3f996b348623f44effcbd3f7d853bc4", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842432, "uuid": "7881cd64-dd10-41b5-ab21-17be32e91972", "comment": "Malware payload", "value": "ca33f34c399803d003da98b75b3eb192195a97618bde71a5b50025431a0cefcc", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842432, "uuid": "a9f6d226-4dab-4d6c-841a-7d92af59d0b8", "comment": "Malware payload", "value": "c950506d6ac232f86fffc9d13197e60db0dd1ca5", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842432, "uuid": "2951d2b0-b035-4964-8952-de88acfd3031", "comment": "Malware payload", "value": "16194e8b57a3f7c0904863408fccf904817d8a3518f0b5fdb50112489abc58884131464b3ef576646b63d839c6d975e2", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842432, "uuid": "57690431-f670-4b88-80b3-72a31dba531a", "value": "T12890021D451050FA5B959134D118440018B1394DC8B0A6DB2105440A0441AA4D66440A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842432, "uuid": "03456d86-6eb6-4af6-b291-10f64c38144d", "value": "3:VSJJFIqF1F65IFWsIMgKMn:s8qF1FEsIM0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773842432, "uuid": "2a3bbf80-162c-4701-9dde-efa8cf5274ec", "value": 51, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773842432, "uuid": "d4d54d9f-4430-4874-b073-0bb7d634eb3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842432, "uuid": "23962b0d-4695-49ef-9899-4520c04326c4", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558f41ad-22a8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773824181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824181, "uuid": "b10eda6d-3b45-4c5b-a2bb-6c986043703f", "comment": "Malware payload (AsyncRAT)", "value": "84a533b478d117c1c6635a6d29611aea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824181, "uuid": "b6f49059-d323-41a0-bd65-1dd134284817", "comment": "Malware payload (AsyncRAT)", "value": "cb9eeb8a64e9071c3df8cd0a1f3867ddc1ce1169028344be4af8e36a35451790", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824181, "uuid": "490766ce-f6d6-4eeb-b526-0aadf08da03e", "comment": "Malware payload (AsyncRAT)", "value": "da47f2c80e7229654a0ca8041dfbd8e7f271a2e0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824181, "uuid": "d0044f73-48ee-486c-b18c-c100af921fcf", "comment": "Malware payload (AsyncRAT)", "value": "ed849e4c0ac7f7fb504fd3a39b42327efaa04ef1f82f6155a28f9230d1bf17f33c673fea20ed981d550ddfd512b21f7d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824181, "uuid": "a552938d-509b-4e07-9ad7-893e7f50553f", "value": "T14324976915DB6D8FE1770A7C00A4323069669C9C3C429D0AF95F7EB7CEF2A4494822FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824181, "uuid": "5b60dc7e-33d7-4cb0-8525-6bbe597bf441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824181, "uuid": "22374c29-59ad-4d2a-b0cd-928493941855", "value": "1536:ouIXlT8kD2iRsJS52UzJrbbtwfbBjqjWEjzNd5yXXXXXXXXXXXXXXXXXXXXXXXXe:ouIVT8kD2lJScUzlbbtOJ2zN/egPVeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824181, "uuid": "5ec21a04-8c98-4c31-a6fa-b116b5ee59f9", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824181, "uuid": "f70b3cd4-5aa6-4c0e-8166-097368c05751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824181, "uuid": "bca63505-d0e3-4ea6-8bdd-142373c5d6ea", "value": "DPRK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99507089-22bb-11f1-a769-42010a9c0008", "comment": "Malware payload (Vshell)", "timestamp": 1773832455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832455, "uuid": "16ca5aa6-9580-41e0-bbe0-72aaf173a502", "comment": "Malware payload (Vshell)", "value": "2a99d70d275f57076b8ed13e7e1e857b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832455, "uuid": "a6a29228-f548-4d02-bc99-3dafab1fd32e", "comment": "Malware payload (Vshell)", "value": "cbbdc9c1a02a8a63fefe971bc390c02e168b41eed5ab81d303c935c7c4b26cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832455, "uuid": "fbc495bb-67ce-4a7c-aa6e-30d8f2f5c7b4", "comment": "Malware payload (Vshell)", "value": "646deda01a01a461caf399e4c894a7f41eead334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773832455, "uuid": "c4ef5d0e-e1e7-4d4b-be6a-034c20e5dfdc", "comment": "Malware payload (Vshell)", "value": "610ff9cad3cacf7c47298dcde8334fd4aecab00e63fb0604a240bee750f60f644dbfd8e82457a4b48bd2e00cadd5a3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832455, "uuid": "2eeda608-2bf6-436e-a76e-ea68535eb9eb", "value": "T139D35B13B54165B8E01AC17883458972DB2778E90F22ABEF135469383FA9BF76F38714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832455, "uuid": "9395db5d-a265-4f5a-87c8-b9b9b41c272a", "value": "9357742856ae9d4c002ea582da555067", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832455, "uuid": "7d8a1d61-3d18-493c-a927-cc6b109e8fe2", "value": "3072:MPKHAtXJekK77rCh9+1bHrrRotHOjwWz:MygtXDGrW+tRIHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773832455, "uuid": "93c30dcb-91fc-4710-8e1f-655cfc67a807", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773832455, "uuid": "9af2a8a5-67f2-4365-9e75-b1ef9897d341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773832455, "uuid": "b9ca86e6-1ba8-4fd5-84ca-129cb0dda5a6", "value": "wanfeng.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074decd6-22b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773828344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828344, "uuid": "7b28f868-5e42-482f-9fe6-3b1d004cdf49", "comment": "Malware payload (Formbook)", "value": "6a38b4b7e8cef4d355c127a835769ae1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828344, "uuid": "7ef64859-ac15-4e68-bd65-89b53060113e", "comment": "Malware payload (Formbook)", "value": "cc9404c26313da4d1c83f107c793edd68da52378d48328d27da16ad72b51b4e3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828344, "uuid": "479ecd85-276a-4fd1-8b19-9949aa5e96ac", "comment": "Malware payload (Formbook)", "value": "84c1341d78640f8692844d5220cb4204311488b9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828344, "uuid": "65bf8aa1-2ae8-4da4-9585-09e5f8d77682", "comment": "Malware payload (Formbook)", "value": "739c1f1e7c9a77b7d6dc80f94027994d1f74f6f5eb17a7eda66118305e0a3286c09517e31d051cf3e574a849e5798cf9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828344, "uuid": "4340f246-334f-4b2c-ab76-5cec33bdf5e8", "value": "T1843502E56852D3C1F8C3C246C5B3D887F2E193569B5B46963831B3AC1889117AA3FCDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828344, "uuid": "b43123a5-866a-4bb1-8327-96a4c3b3e111", "value": "96:QYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYu:sPEweNrPSMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828344, "uuid": "f5125265-82e8-4213-90e6-c5b067a2aa57", "value": 1134697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828344, "uuid": "3d571549-d853-4642-a337-f4a64cb5d212", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828344, "uuid": "c7b456ef-a5d6-40ad-b1e4-ba0fa2a20f39", "value": "6a38b4b7e8cef4d355c127a835769ae1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f460c8-2322-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773876847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773876847, "uuid": "955f03b3-e2c9-4a66-bdb3-916e75b64bfa", "comment": "Malware payload", "value": "5bd635a72d6f89af394d98e025939eb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773876847, "uuid": "28ff9905-0c68-4a66-9a12-d1f4a083652a", "comment": "Malware payload", "value": "cd3163a308ba40c3a5e153c0326b7cf23a36debb6255624f9afb7e7ca5182391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773876847, "uuid": "2ebd3bdf-d2e5-4826-b268-3b5ac228fd07", "comment": "Malware payload", "value": "6717b8d7be18ea5cdb5944c5b259e022496c6485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773876847, "uuid": "f3e0e578-5b88-42f2-9f5a-44cfad03b8ef", "comment": "Malware payload", "value": "7c386c3d3862ab773d69f8015a92a68c916f9b3020c592584b308dd81b359e35c09936e064897e92bdc5c9623c696bf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773876847, "uuid": "4fbaa6b1-a919-4617-9bfb-4d7ea89219fd", "value": "T117759D16B2AC40B8D1ABD279C9575907D7B578050B60A6EF27D08BE23F13BE11B3E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773876847, "uuid": "1f1740b8-ee7e-4f14-ad83-87048dd890cf", "value": "58954d9bf2468e612a3506e2fbe98d28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773876847, "uuid": "caa5001a-6f96-4979-8b0e-826ab267744a", "value": "49152:hAHYAJvnzT4bBoz2G0XkzAObnAPiDvY9zxZpY62TZ:hAHYAqdKkkzAObnAPiDKxZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773876847, "uuid": "9ed4716c-3978-488f-82bf-adcef5cb0119", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773876847, "uuid": "d1d75cf6-e300-4098-8460-759e2ef0602c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773876847, "uuid": "103a5fe2-a37c-4f28-93ff-654531667a56", "value": "vcruntime140_1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2a6f1b-228c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773812411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812411, "uuid": "91fe3931-446f-413f-b917-ce9b750001b7", "comment": "Malware payload", "value": "eaa7debe272bb6e118761eaf3119f293", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812411, "uuid": "31ea437b-b2dd-4e57-bab8-a8a35c656096", "comment": "Malware payload", "value": "cd4807739ed630631defac9dc0e517ba94c88977dac9692d797477d32e99c15a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812411, "uuid": "8c2dbf89-b632-442c-9c94-3de5778f4025", "comment": "Malware payload", "value": "72e25ca9380d7e69732ab39120209700c4f8e0d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812411, "uuid": "2f9ef625-140c-49ed-b14e-51090a403dd6", "comment": "Malware payload", "value": "86a605b8dc55881bc33f4a4abf6502abbf33377210c0cc69710d5d781442f960924ca90be4d5490b9a12d239c2c02f81", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812411, "uuid": "b6f1f027-d651-405b-aba0-9287d44d5674", "value": "T1E5547D01B951C235C05001F05D39BB317A7EBE696B3DA68733C9B9AC9FB2360AF42257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812411, "uuid": "7dab0bff-64ba-4a9b-bcb2-b09dc41784e5", "value": "862da41bcfbd7abb2760e900e2ec77ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812411, "uuid": "81da36b6-a665-4b1e-b671-19140040ed56", "value": "6144:L/FFJOF5+++QNngrA2tfMlRTKaQI6NLzXd5wdBwjq:L/k5++rNnKGdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773812411, "uuid": "f7e2b1a2-a9b1-498e-8d61-9ca4759b0343", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773812411, "uuid": "59657d5f-43ed-41f8-a61c-9026b050b9d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812411, "uuid": "f5570e88-2e1f-4a03-9650-fa22a952b615", "value": "midas.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947f8681-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801523, "uuid": "bb3a112c-26ce-448d-8302-014f0d473e99", "comment": "Malware payload (Mirai)", "value": "1b456fa3bcb3ecb6763d0b3c536f312b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801523, "uuid": "4bc0457b-56cb-4ac7-a866-e3ad1554ee9a", "comment": "Malware payload (Mirai)", "value": "cd8c20e2904756ef8f35f2ac9bbfd500d1f7bfb9db2376cfb1b057fb548fc9d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801523, "uuid": "b62ef9b7-a914-4f3f-b1ab-6c674f007037", "comment": "Malware payload (Mirai)", "value": "ef9cf8c2d7b6000eeebd9c5f111f990622d04172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801523, "uuid": "af2aa5ce-e32f-4752-93a6-72c0951c1937", "comment": "Malware payload (Mirai)", "value": "d23a1c909608705f21bdc007524986d26e8ffb5c80e0f5c405128899936daef7740e01733397e8533db92a6a83f9599a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801523, "uuid": "18ae8fab-8d68-4ca8-a8d7-ba8a62980286", "value": "T1B993C91E6E218FBDF759C33047B74A21A79933C627E1C685E16CD6112E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801523, "uuid": "a0614357-235b-4452-a086-165cb066154a", "value": "1536:VT5tJ3ra3+XZP9n3t2XHsFG0wSEpXeSrFZ5as/SL:l7J3ra+Xl9nIXHqG00J5SL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801523, "uuid": "6efcc632-9499-43d9-a680-52fc9c6ed5e0", "value": 97596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801523, "uuid": "6c25067c-dba7-4e7e-89fe-6b95d99433ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801523, "uuid": "c8524971-9e87-4212-b03d-ae1e593b667a", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4171ed78-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800954, "uuid": "e8d90f2b-1212-416f-a97c-8ff36d37267f", "comment": "Malware payload (Mirai)", "value": "eb1686ddead4b48b20ea89902c5402fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800954, "uuid": "8111c5f6-5943-4a85-ab00-5957df5b6de4", "comment": "Malware payload (Mirai)", "value": "cea61191aa2b73cb5c87619d6f829b91002db7acbf4ec9a1bf6fa8dfbb770a73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800954, "uuid": "b3e6a643-6fb1-4dea-8669-4a5a9598f503", "comment": "Malware payload (Mirai)", "value": "ef4808c9689cd1f82e5c213431555b06b45daf23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800954, "uuid": "09061c14-9342-4d85-a8af-56064c899845", "comment": "Malware payload (Mirai)", "value": "174a143d2c414b2d70a70696df274cf58d9662656bb9c98aeca04f23a7cb5f585b1c38f82d3eddf72e9d9bd064c0c496", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800954, "uuid": "a031fad4-3b42-4c86-9866-e3981d59bca4", "value": "T1BB4309DAF800EC7DFC0EE73B8457080AB171E69945821A362367B967EC362E44977F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800954, "uuid": "a9de6ee5-f34e-433f-b1c5-719fc7df942e", "value": "1536:GyE86QR0waTxTW+T708Ep3IgnM65+ZEyLXvxFZZ4D4E:GTP9W+T7Wp3J5oEEf44E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800954, "uuid": "a21011e6-2547-4035-b6f5-fed1c24f5d09", "value": 58032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800954, "uuid": "c14a5851-53d7-42cb-a520-d16bf5c24eb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800954, "uuid": "6819e7f2-5038-4042-b8d5-ab600e9d1c20", "value": "dontcrynow.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbcbbab-2311-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773869209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869209, "uuid": "6a4df07f-fbb1-4410-a10f-cc2c9c79c47e", "comment": "Malware payload (Mirai)", "value": "5980195b99280330934c07ae1e1a6056", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869209, "uuid": "456470a8-a072-4941-a4d4-c624cf667d3f", "comment": "Malware payload (Mirai)", "value": "d00613609ccf814722aa10cdc30742d2494dc24d9c2bc8b6150d489b945c323a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869209, "uuid": "aec56b64-1df8-4e37-8236-6f90236064ed", "comment": "Malware payload (Mirai)", "value": "289ff7fb55017b56fc2ef18ac9d37a1d8eafe065", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869209, "uuid": "df886b93-5e3e-4e72-92a6-550c94b8503f", "comment": "Malware payload (Mirai)", "value": "f09ab7dfecf20e0ff6c95cc0fdd7ac3aa6f5cf26b476fe743167537e3e5eec8a02122d6e09bf3085cdb87c43b0d55369", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869209, "uuid": "6da9955f-ad7b-4fdf-bb6d-59c335e7da59", "value": "T138D3F70ABF511FF7E86FDC3706ED1705299C655A22A83B797634D828B64B24F09E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869209, "uuid": "ba4430fa-f0e8-46da-ad57-834ede6efe1c", "value": "3072:PdcqBnvRIw9uWuvoy2F1aCDAqB2x0nrT:FhBnSgTuSzDACnrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773869209, "uuid": "cef3c98e-2a44-49f1-8a5f-b2b6f42d0c31", "value": 134040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773869209, "uuid": "ad04a499-2afd-421d-b2c4-10f8e6420ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869209, "uuid": "ec32a307-c477-40b0-ab11-5310fad8ccf4", "value": "tux.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ccc13a-228c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773812398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812398, "uuid": "7759b6a2-523c-474e-8153-7d48151232f7", "comment": "Malware payload", "value": "82ca22ac870215a9cc83f30519c4c7e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812398, "uuid": "1fd4627d-cbca-4a7a-9921-249509fb5ff2", "comment": "Malware payload", "value": "d03def68752c121c8091459f3010a5efdb3d86dd83965037fbb1eff7203bafc4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812398, "uuid": "0c20dff8-cb53-4ded-8196-3a76b4d05b86", "comment": "Malware payload", "value": "4bb97d7f420a65cd5ad010ae33368957f09e9858", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812398, "uuid": "a469a225-8a61-4227-8f50-27b863962a9f", "comment": "Malware payload", "value": "e21a2d9544d10b21158dd3ba2ea9d4cf39c0faf930a623e33c87bd65c865f9c6e44ce3d6a75d972bb50213a2d421a673", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812398, "uuid": "919dabc3-8b31-4d00-8ca8-d9775e469ec6", "value": "T104D32A43B1948979D02D453B9C17BAA84DE9BD316C2085BB67F97F8DAC3B3412C0929F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812398, "uuid": "4b542a78-118a-4239-9977-dc2bda7abfc5", "value": "16a120fe0300a5494a4a5354f3e99958", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812398, "uuid": "cd2ac24c-f270-43d3-a664-25a181b7decf", "value": "3072:TJUbVDU9zGcRsA4hciCDPyJhEf/pH1HaiPYECE9:sDU9x1Tcc/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773812398, "uuid": "de59e093-f5cf-458f-82f0-5f5fdebd4dc7", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773812398, "uuid": "d1874063-97ad-4e7d-904c-aa1d6d43a6d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812398, "uuid": "2707df29-1e97-48f5-a466-70d277d8beea", "value": "LdRESD5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47edb459-22c9-11f1-a769-42010a9c0008", "comment": "Malware payload (SideWalk)", "timestamp": 1773838331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838331, "uuid": "d4b23605-69e1-4545-a71a-23767aec9b6e", "comment": "Malware payload (SideWalk)", "value": "89339821cdf6e9297000f3e6949f0404", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidewalk", "colour": "#446C91", "exportable": true, "hide_tag": false }, { "name": "UNC3886", "colour": "#CF61DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838331, "uuid": "25620735-d712-4c6e-be2e-2f04cdefb73d", "comment": "Malware payload (SideWalk)", "value": "d0d65539d2aa308a16d29b02e74c7a7e54b87a7f7e6b880960d47561ff73f5ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidewalk", "colour": "#446C91", "exportable": true, "hide_tag": false }, { "name": "UNC3886", "colour": "#CF61DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838331, "uuid": "e27c3653-ea76-46be-b008-00ed6209f88f", "comment": "Malware payload (SideWalk)", "value": "8dfb13a5a8a50d3405c22d259c0a3b21361d293d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidewalk", "colour": "#446C91", "exportable": true, "hide_tag": false }, { "name": "UNC3886", "colour": "#CF61DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773838331, "uuid": "ce3f39b6-b9c1-46bd-b7b0-4a36c9f86961", "comment": "Malware payload (SideWalk)", "value": "492ee23a3e829d6f31f0aca00f0766d8789fec581aeb4e9329fedb8141f46576c6a2aefd5edff366d3ea6ae6956cb999", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Sidewalk", "colour": "#446C91", "exportable": true, "hide_tag": false }, { "name": "UNC3886", "colour": "#CF61DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838331, "uuid": "08108d48-0252-4c3a-82a6-1bca89addd9e", "value": "T1CA646C17FF854CFBC0C9DD72859FC366963078868324602A75C98B087D5BB648F2E7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838331, "uuid": "67d3c0ee-9179-45bb-9190-e5848b8c186c", "value": "6144:EJTQkAIg1STxhjed6n9ntr+AojA5OixM8ztJGwxiTt7zytazh:UQ6//ntWjA5OKM8hQwxm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773838331, "uuid": "89d4c7c9-0ad0-4eea-a410-0cae8a834f6e", "value": 324112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773838331, "uuid": "29931d11-3f2f-4758-91c2-d649d6b2dbc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773838331, "uuid": "06393a6b-3da6-4c6c-93cf-e0f6a2df3fa3", "value": "ksbubba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3be97f-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773826505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826505, "uuid": "ea9e9688-5c27-437e-9ad5-758c90f33416", "comment": "Malware payload (VIPKeylogger)", "value": "5716078f8acda92e4af2230d5e67fc03", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826505, "uuid": "1c782a78-7679-47bc-aadb-a64a0b9de19f", "comment": "Malware payload (VIPKeylogger)", "value": "d10b090fd31b41acf8e16ee5df9a7b79eb1c8ab1a75979c345ddcf0f8e21872a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826505, "uuid": "0d6640aa-2ac8-4759-809e-27f0a6923da3", "comment": "Malware payload (VIPKeylogger)", "value": "85241617a95f0c53ddfa980b9ea648d5d517254f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826505, "uuid": "2aae522e-5646-42f2-8e03-7104e9285a47", "comment": "Malware payload (VIPKeylogger)", "value": "cac3e4d325e8df7cec6030191536259400b36dbb9049adeb122b8db3ac3d541d3fa5f1d016620727a3075245d2d4f091", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826505, "uuid": "306ed275-717d-4d36-8ee4-622153bbdc03", "value": "T12555DF116E4A6B68F2BD0B7CC057085C2BF5D047F3A6EA1FBFFC94A62952B42C927501", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826505, "uuid": "df963849-20fa-4af1-a0c4-78b7d84aae8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826505, "uuid": "63d66d2a-9311-4603-8c33-f2b144c46301", "value": "24576:fw26Znb7i3AuSmCsQcAPNKh7hNnTgklQ:fw2cbGpSmpQFNK93nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826505, "uuid": "72fa9e19-7511-4572-879d-69d7d7836d61", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826505, "uuid": "60b58971-05d8-4118-ab13-cebaaaf771f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826505, "uuid": "ad1e9d25-562a-4b80-8ab5-1072dc8efa19", "value": "DHL_Overdue Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baa8c08-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827573, "uuid": "c53ff918-25e3-4717-bc81-9f2ee1f359d8", "comment": "Malware payload", "value": "a11b034717e252e8df508af4194f802c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827573, "uuid": "50e7f2f5-787b-47e6-9bf3-bda309805bc8", "comment": "Malware payload", "value": "d1b77de715ea1a66e9769029c71cf2f738223026488657cce03dc6a16de21e43", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827573, "uuid": "c71b4836-104e-4060-9153-b605b668728a", "comment": "Malware payload", "value": "7cda5718ae66461764f0bc987af05cdedf79d472", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827573, "uuid": "4951f254-fd7b-49d4-bf73-54a379153b1b", "comment": "Malware payload", "value": "02c2fbb5d90bbc1b31e45dc1be0e96150c26ef4e25aece3248b6e21ecdbf5be14b44752b80606311b04be581266cc929", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827573, "uuid": "93654654-b723-4306-b141-ead1ffe7de9f", "value": "T146C5127961A61EEFC4213217035C741F2E95805798F8AF464B638EC3416F70A68FABE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827573, "uuid": "b08da7e5-f832-4a14-9be3-477284a20ff9", "value": "192:cbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbN:paM8lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827573, "uuid": "ede9aaf5-0cca-4936-9b97-f4674a6b0d7c", "value": 2550870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827573, "uuid": "0ad868b4-56b2-4821-a69a-ee933176913c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827573, "uuid": "93d3f62b-aff1-45f0-8176-a4a98884199c", "value": "a11b034717e252e8df508af4194f802c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7355ada-2275-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773802547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802547, "uuid": "0fcf1b5c-406d-4fe7-8544-35f8cb433df3", "comment": "Malware payload", "value": "b91d3767c1b7a62072097633f91ce30e", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802547, "uuid": "95736bf9-e3f7-425e-9867-c970c05ec367", "comment": "Malware payload", "value": "d22abd12ec7ae97dac9982eb07f46106075502f8844ebe65fc529ccfceecc851", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802547, "uuid": "96e32cfa-7697-4806-bde0-29402d637444", "comment": "Malware payload", "value": "9ee59968b260cedca8ba985df1141110f2411633", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802547, "uuid": "0aab413e-ca06-4473-bc1d-2f48664921f4", "comment": "Malware payload", "value": "8111256e94cc552e2e2529b262963e4b24561300a68ac1e4d092f05bad793963164a3d6547354fd90c814857f264aee1", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802547, "uuid": "4063e8c8-8670-4012-b83b-8f6b7107bc17", "value": "T148872319FB0DE82EDED7B07C4D9A025262663C8D8210C35B6521F21DFAB76D44F2ABD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802547, "uuid": "eaf26018-184b-4daa-8b72-35c027e832fa", "value": "786432:9qI36C5IiDp2kJvpYQ90g6PA+ZXNQQQQQQQQQQQQQQQQQQQQQQQQQQQQQATknzYF:8I36C5fAkJhYK0gYA+ZX/knz8u8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773802547, "uuid": "3542424e-1aa6-4fe5-8f08-b69f90c47ddf", "value": 37024089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773802547, "uuid": "0590751a-3cfa-4ea6-9b47-54d0d8df2c15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802547, "uuid": "64251a64-9db0-4b67-b343-016bf89d55db", "value": "com.phoneclean.highclean_1.0.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76dc549-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827888, "uuid": "9842338c-8a22-49c7-a63e-de0ddc7fe6d7", "comment": "Malware payload", "value": "fc721c7295da1e54a0bac61ecc76655c", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827888, "uuid": "fe9dfa90-630c-473f-87e7-b99bd089af23", "comment": "Malware payload", "value": "d295d298b3eae41a3c84bf0d3263590fd853dab0eb7199d209e38442996cdc81", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827888, "uuid": "0ef55bd7-79ff-4866-9f5f-8c2c2135fecd", "comment": "Malware payload", "value": "db26c2eca941754e8106cf87b95363a8ed644ef5", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827888, "uuid": "72f2350f-25aa-4080-8526-9a8430684611", "comment": "Malware payload", "value": "e34be1665da975061f9d6b8c2d9a3e0e724b9128cf139370f9830775157e9006bc24fdfc3a49003d7bbb6a3064503c48", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827888, "uuid": "449a87ac-324e-433b-b02f-b622baec26c8", "value": "T10BC423443901C1DD874A6F3E9DD84EB46E7D80E79A5A790027CEBD827D85AB033C9D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827888, "uuid": "d02ab952-e97b-4d5e-8ae1-7e1346d4e244", "value": "12288:VqwEDcCCXb6wlOMWROC/FTeHo22Qm7NzofOr/mShZ:igCCT4MQOC/gHozN7NzomLmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827888, "uuid": "291120a9-df7d-43ec-8ae6-d07ca43c414f", "value": 578949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827888, "uuid": "1e4430c2-7939-47f8-82ab-ca40fd0326b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827888, "uuid": "283d5ada-41bb-434a-8c0a-1541e3cf97b3", "value": "VALORAN_DRIVVE_Hack_Cheat_EF_nephrosclerosis.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16260cf7-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851562, "uuid": "236fa48e-3ae1-4d5c-9fc3-c9512b0dbee8", "comment": "Malware payload", "value": "16e83ac8fc47d53aa8a06acee31b9191", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851562, "uuid": "0fbbcce6-5134-4823-862b-59b3a2585514", "comment": "Malware payload", "value": "d2a522a800ed42cc8150454628709f73d1982fadc8a989887ff9a92f75713306", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851562, "uuid": "f5f19dfc-fe27-478b-b877-c4e656b07f27", "comment": "Malware payload", "value": "a6a6a14fa230c5b1e92719de224ca2e610f859d5", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851562, "uuid": "311a6a7a-f7ec-4008-a3da-14b8ee3f9f53", "comment": "Malware payload", "value": "a93c7c7a379cf6a2569dd65c5c5c2e7ddd4efb56f64842c77104636ce2435fec3f203d924ae94c81a76b70d711e5ba52", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851562, "uuid": "a1c60667-1156-4c0f-87a8-0b2e4135ad17", "value": "T13AD30226CD2CC3D0877923044A1F9643BAEE31C39B9AAB27B52DB4097F7527CD15463A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851562, "uuid": "3028d77f-d0b3-4d25-9f40-f628f063688b", "value": "3072:nX7f4CtbJIr10s08ZiixwfINkLiYIqTSLmChKBM9/71/Ils3jVFK:LQqbJKE8BkukKLfKBg/do0jVFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851562, "uuid": "2e5bb31c-feac-413b-9865-7c247ecf9f7b", "value": 142880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851562, "uuid": "62005ba3-5629-480b-9518-6f36d0f4d642", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851562, "uuid": "981b4bb7-fb8d-446b-b097-88142f0fee41", "value": "1PhMAR17_Annnnnnnn.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4777adf-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773828232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828232, "uuid": "5d9a90e8-2186-4d2d-b83e-961bd15c3aaa", "comment": "Malware payload (RemcosRAT)", "value": "e9ecc7ef719446f8049dc8cf8475430d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828232, "uuid": "32b2d8ed-fc1a-4b35-922a-de8dd305eda3", "comment": "Malware payload (RemcosRAT)", "value": "d3128d0f1df7f825183812b9e829fe1e0d80fa706c028e601f10f2cdbcdddd59", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828232, "uuid": "a2d5580b-0592-4a15-b8be-efaa348cbe53", "comment": "Malware payload (RemcosRAT)", "value": "a15f8bd807a25538bdff4e25e0c9ff75963a8601", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828232, "uuid": "d37f3346-8d71-4258-8c59-25d0f3c6f4e4", "comment": "Malware payload (RemcosRAT)", "value": "29e3386f33a7fecc17972a43857fbc6861f16906e5853776f85bf325afd3d700df9f441aedc40677800c85b4a114d4db", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828232, "uuid": "7ae40726-a973-4677-b832-397e7c7a7a27", "value": "T18BE518C9D86038DF407FAE6142DFC81B9807FD1769F969285109D4CA2CB9B1EE8D4EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828232, "uuid": "7b717549-baf3-47ed-9c21-b154f395df72", "value": "192:iNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN4:aoyAV4fO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828232, "uuid": "c623f5b9-2731-41b8-bafb-25913d568c7c", "value": 3300371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828232, "uuid": "34eb8e81-4c8a-408f-b173-76f45f398366", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828232, "uuid": "9321c110-89cd-4a1f-a0a3-dc371021e06a", "value": "PO# 07845.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbe4f33-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826449, "uuid": "736cbee9-123e-4288-a1c2-fbad35bf386d", "comment": "Malware payload", "value": "8fc899ffa66dbf28ecc6d0741814667f", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826449, "uuid": "ae9aa32c-8971-4b41-9909-52d77ad7c91d", "comment": "Malware payload", "value": "d3ecfb8dfe6c5b3821b1322c52b4d65582b1303c2bed288e6154a23b08cc3de5", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826449, "uuid": "ed3cdbf1-c722-4113-93d6-ebd972220df1", "comment": "Malware payload", "value": "84f22bd186a5144bb17cdcdc4875eae3b6f10d9d", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826449, "uuid": "44835b2b-1f89-4c54-b15e-0337a84caca2", "comment": "Malware payload", "value": "ea1aee50bd82e5f94e81311d046424bbfe679b4a139ac3e416bf70703c891feffab130984cb0208350b448134418e27e", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826449, "uuid": "f9481bf7-332a-4ed8-be0c-337aeb212ecb", "value": "T1FE5324948CEAD39DBBED48177F12E7FC4B1AA813A161144513DFC08BB42AF239C6566C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826449, "uuid": "bc6f1bfc-5bf0-4d62-9ab5-4ff9d401903f", "value": "768:OTB0BR4RdNbsrlA8vXvDK3j48BSLOlMVZCS2Aexog/pDNKV8EW7NEw0kRgZ:BcO9B64eH9S0Ow0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826449, "uuid": "f0447541-f4f5-4295-96c9-88cd19d4b154", "value": 62553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826449, "uuid": "e8bc6131-eef7-4cb4-964e-86b586ec7825", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826449, "uuid": "78a01044-31ed-44ab-a0d7-3374afce94cf", "value": "8fc899ffa66dbf28ecc6d0741814667f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e29185e-22a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773824195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824195, "uuid": "346e3848-d223-4a7a-bc49-1b4657cd9c09", "comment": "Malware payload", "value": "6db636103c7355eaee6c9d592feddfa5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824195, "uuid": "e3a6cac7-162a-41c3-aa07-328f5622a264", "comment": "Malware payload", "value": "d403a2389d93eec66a3456bed1f9e7a0c0fd7b3ab853430e01d4590d4188bf28", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824195, "uuid": "34bb6bde-e292-46cf-9200-06fd69e5cf15", "comment": "Malware payload", "value": "1b10ac81a3bc9fff21781f15873153afd4640027", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773824195, "uuid": "9d81b69e-a549-41b7-843a-6949091d32b3", "comment": "Malware payload", "value": "b38ac2a7b52ec27e83493e0cc075c806fef2b0d5a6bd20f65c13214597c512d13180b719de9502b65c6fd500bc5854ec", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824195, "uuid": "d7750528-f074-402f-b240-740c4d6d9492", "value": "T12B418545BC56CF6BC6A3484BA89E7578048EB403C190C472F6EFC79A0F4EEAC9342594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824195, "uuid": "808c7dd3-2d53-40af-9360-d1402fbc9336", "value": "48:t1bT9rfRv03HME+kZv+XOovi79JV8RU3cP3hCyF:/9rfROp1w1K5WUMPRrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773824195, "uuid": "5e3802fd-e1b0-47a8-8fd4-16d494b1edab", "value": 2063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773824195, "uuid": "d1652825-d972-4009-ab90-0f8c387c45fc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773824195, "uuid": "595b4236-5572-4e25-a10f-54b23d5533cd", "value": "6db636103c7355eaee6c9d592feddfa5.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8473e70-22d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773842492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842492, "uuid": "f3a98014-1bad-4a0b-8c07-765df55bad1c", "comment": "Malware payload", "value": "ef32d7f41373550cb35e48c73ce5a92c", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842492, "uuid": "d59fbe95-38ae-4869-a598-2c60e5bb955c", "comment": "Malware payload", "value": "d4e28d5cfe20cb35af70f03deb0855247fdc388108163d1c733beb49cb849c53", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842492, "uuid": "43fabef2-3aa9-48e4-890f-48b8b846bd7a", "comment": "Malware payload", "value": "07723513451e7af83e3a44c5cb477524c3b7f424", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842492, "uuid": "f7ca8db3-1378-46b8-b38d-0614140d20a6", "comment": "Malware payload", "value": "0277790124779c6c92595b0a74ccd58f37372167e49a6f5e70a8643d2ad6a084ca20fd30fffa2e492a12aa6c3a627708", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842492, "uuid": "0a75ef33-15e2-45e0-a3c0-e6bafc74f226", "value": "T1CE92B7166AB300216957C0BC6BA79746333180079645CE2E3FAC5294DF8AEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842492, "uuid": "f7e952fb-f7aa-4dfb-a451-8457f21b4908", "value": "384:OFTAsXe7FUF6/+9MA1ksb7Rpsa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILne4:g8sXe7FUFP3fsafWkkg1kVKUO6IkV7DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773842492, "uuid": "d2eeb32e-cfc2-4a8b-8d04-ec7d88780505", "value": 19648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773842492, "uuid": "ee92d554-4f0c-4cf3-a728-ed63fd6c4deb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842492, "uuid": "b07ec2f6-f16e-4917-8108-e0b932f552d5", "value": "d4e28d5cfe20cb35af70f03deb0855247fdc388108163d1c733beb49cb849c53.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b14489a-2295-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773815976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815976, "uuid": "c610832c-bfe1-4036-b850-92148d6a189c", "comment": "Malware payload (ConnectWise)", "value": "f13b26c2d4c8f1d536519b947c7300e0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pinpadat-com", "colour": "#44C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815976, "uuid": "ebe17686-b45d-4fc6-8536-fe04d5c31297", "comment": "Malware payload (ConnectWise)", "value": "d4f085a345cd8a3f662711ea7f8f72084bb7367085912028b7f4acc4e30f3d9e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pinpadat-com", "colour": "#44C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815976, "uuid": "994ccf80-2373-442c-a575-cb5c9ef0216a", "comment": "Malware payload (ConnectWise)", "value": "1f3cb51b08573ff89652a65482e630baec0f5a55", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pinpadat-com", "colour": "#44C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815976, "uuid": "9b10c9d4-da9f-457f-ac96-4673e333c3b7", "comment": "Malware payload (ConnectWise)", "value": "34a6c68915f4ab9ba2c6f5200a3f1e5b9daae27ffdb4276f1f47a20c9c3e9e96210e27f1942c69d8607ca86a8570dfd4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pinpadat-com", "colour": "#44C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815976, "uuid": "58b10bc9-21b1-4f12-94fe-ce303600e7e0", "value": "T1B116332BD33D3642E87D94718368638A5DFA6386593B3C4BEC5C59B38DB4B0C097532A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815976, "uuid": "16738cc1-1a10-47b1-a356-84c7c6f36c28", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815976, "uuid": "c15b3396-e750-417a-95de-448b0f484438", "value": "98304:9j4AAtBxY3UFZYIGG+POhj13AQ+6YjuuCfUuQ9oIhYZiusm3av7T:9j4l+mN1+mhj13A9qZnQ6IhYcusmi7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773815976, "uuid": "2c86b4a7-435e-4e9d-aa35-84a04f12db77", "value": 4292664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773815976, "uuid": "d0cc6af1-3d48-4500-9346-21f536f0394d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815976, "uuid": "c2b85f64-8346-4626-b9a3-f8a1fcff9d3f", "value": "d4f085a345cd8a3f662711ea7f8f72084bb7367085912028b7f4acc4e30f3d9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7de77d-22d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773844134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844134, "uuid": "e2d2a6a5-6d43-45a7-a1ac-2eca188b5a17", "comment": "Malware payload", "value": "1b8c31e19dacc7cb08b943adf27b687f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844134, "uuid": "7fa9d410-9201-4f5d-ad7c-56d6d9fb73c4", "comment": "Malware payload", "value": "d5202780fa8879955093dd41dcd0617e5a36e0937be8d3bddc9677142491802f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844134, "uuid": "f05630dc-b742-450f-8984-bc491f30d98f", "comment": "Malware payload", "value": "f955ea3d57bdd0d7c12bdf8cf70563b70a1329eb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844134, "uuid": "e136ffe0-f7b7-4717-b60a-38211cf5d4cb", "comment": "Malware payload", "value": "f4ce249c17892cc79be6740d57a486a6911d214ede1e1ff6c38ad29ede7e326e9c54d5979dc040e8de9f618be35b39fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844134, "uuid": "1717c2ce-48e7-41a4-9d26-2d601e0a84c4", "value": "T1A7925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844134, "uuid": "5f164c78-2504-409f-8860-a95cd7fac858", "value": "384:RLFcuQpWx+BL0SWL0gizsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:RLF8i+BL0SI0tzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844134, "uuid": "d6257a8e-8882-4578-b3b9-a89bb7b11886", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844134, "uuid": "8fb55483-5580-4874-8e9b-984d01dd6ca9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844134, "uuid": "dc119add-cc3e-4e06-afe3-d6cb4d276919", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be34c86-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827251, "uuid": "bb20a2eb-88ce-491a-a8f1-418d02656f66", "comment": "Malware payload (PhantomStealer)", "value": "19c42b2eec0d61785fe289546eddb20b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827251, "uuid": "7a13077e-44cb-47c6-80d6-5c5ff003c9e9", "comment": "Malware payload (PhantomStealer)", "value": "d56379c499c30888b7948ad51f0f867670e2d8e09c85a05b34ac7363e68060f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827251, "uuid": "c6edcd85-1ffb-4c96-a6bc-03b32ed1320b", "comment": "Malware payload (PhantomStealer)", "value": "766884b5f1c592f252ca98929acb06a8132c6864", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827251, "uuid": "bb176b7f-8e24-4ccc-85cb-9bb37bcc15e0", "comment": "Malware payload (PhantomStealer)", "value": "4444f9a5e7e372655480523bae7058a785b40e8dd6bb6ac62c6c06af7a83844690929c3742ebdc4bbde166e7f904285f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827251, "uuid": "3e8c6d66-20ee-4764-b873-bef3125b1e18", "value": "T11C269E087AC077FDD161D96EB47D18AC88A1915EC19923DEF631FF288F19358B2C78A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827251, "uuid": "bafee1c2-6fc8-4068-ab6b-1bbea9b331e1", "value": "24576:pjUK0G3plqJztXmrMXPaAVIuqzkPKm5VTBmui0xAnLssh78gF4MZt1YmduVlW23T:p78ZlVwhGIDcitCBd2MN2VyWt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827251, "uuid": "12c86712-ef8a-455d-959c-27d5971095dc", "value": 4574695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827251, "uuid": "6f110908-312f-485e-9b54-33fdde13816a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827251, "uuid": "01ae8b02-bff3-4b60-a4c4-065b667e9247", "value": "19c42b2eec0d61785fe289546eddb20b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886f40df-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851754, "uuid": "39976017-70bb-4658-b770-e966ed442500", "comment": "Malware payload", "value": "62a89d5a892f06650bc85dca27c1df69", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851754, "uuid": "ab4d3355-ce87-4556-8dab-55dcf2897deb", "comment": "Malware payload", "value": "d649590116ce05064fd6b700c28dfcac0e843311f128ccbaee8320aec10ff45a", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851754, "uuid": "c592b269-77c8-4e0e-93d6-95daa63e5f51", "comment": "Malware payload", "value": "aa456779040ab1575c1925cbafa1b86b7a6d691d", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851754, "uuid": "fdd06d06-3753-4c0e-9066-9463c44c6d8b", "comment": "Malware payload", "value": "f630e560eeb7db1058e3ce232cdb9bfab608d7db0920e72f497b7386e34c1d567f3ade732f22257506dae06d75cf9d7d", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851754, "uuid": "705c0173-0e1d-4e46-af3f-5d206b5a9972", "value": "T1686533714D1D2CBE6A38E87834AB6E0D52645F86188EF0B7F79944E7633D3962C0B09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851754, "uuid": "dc8029a9-1efb-46c8-9a26-f9b0ee73c2b0", "value": "24576:I4EeKpPeRXCcwLMgayC9Diu90lgn8gtPIecJq1BZgEoZJIRoXQ5cAM+6dOYBh1Is:celNBGgVyejCplEkO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851754, "uuid": "8eab3319-a0cf-469d-98fa-ef482999a81c", "value": 1520504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851754, "uuid": "774020fd-8365-45b9-8d56-d9088d2c33d0", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851754, "uuid": "9c5086a1-b016-484f-ba14-1b01bbead0b5", "value": "1MAR17_Philli-Viooooo.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a7a68b-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827291, "uuid": "693f432a-4a9f-40c0-805f-e025a5b8a6de", "comment": "Malware payload", "value": "f2cbe8cfeea6d652ef2a4631e1fef90e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827291, "uuid": "bc973c77-a98f-4dad-a319-28b408a022b9", "comment": "Malware payload", "value": "d6eae7d7c70b84b8ebddc1d559dbead7609b621b65161e06719e7cc4b4165d21", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827291, "uuid": "50763e2a-e791-4fc9-b428-e33a035d4fbb", "comment": "Malware payload", "value": "b629714c16c3e06d0ac9502ba8b8b0ec0bad46d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827291, "uuid": "39d02a3a-8c41-4e7e-9ca4-3a383aa3ac2c", "comment": "Malware payload", "value": "813a3448b10beb6daa1cfd3e4921a288e9f10d6f4105b3455af639d89dbbf41850c8256cfae9a0de758cf7287e2974be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827291, "uuid": "57298f7c-6998-4724-a5b9-0c82597d9b4b", "value": "T1AAF31230BB4A6D7C9371DBA9D8E253042BF931C1B8A73AF103CEE889115D931B038E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827291, "uuid": "c3093f7c-747b-47ed-9701-e0b568b9ee00", "value": "3072:IXxP+A2HDKwXUCM5hZ7FA7JWJxgTPQ4fLyNxv1oD0vzo1rbXy1I2zjZjo:IX8BDKuUC0hbOAkJD4xtLzo1y18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827291, "uuid": "8f370096-906f-4da1-b6ce-ba6d25f1e6e4", "value": 158488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827291, "uuid": "9f62ca15-c978-4c5e-b120-0245a2c8f214", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827291, "uuid": "96efdfa2-b8e9-46cc-bc98-e96f7956e208", "value": "f2cbe8cfeea6d652ef2a4631e1fef90e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4002c7cd-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773827580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827580, "uuid": "c9214c55-4df0-4ae2-849c-250f068e0eaa", "comment": "Malware payload (XWorm)", "value": "889c4f9f13aa21a9eab7008bedd83712", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827580, "uuid": "83e17873-2fd5-44b9-a041-1daafd2abd0c", "comment": "Malware payload (XWorm)", "value": "d7ddfb3392d2fb5bdcb01834b9ad05d9b0b8a62aeed006b0962798808c6ea94c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827580, "uuid": "9537f5c7-6721-46e8-a854-a9af9451024f", "comment": "Malware payload (XWorm)", "value": "55693e69a5c1640c79ecf11af5510ca29442f087", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827580, "uuid": "c1bd8ede-4acc-4fb8-85e9-9f5d895b6842", "comment": "Malware payload (XWorm)", "value": "ade419e14ec870427c831566f6c96eff5c85c1d95cf2515956cb9e8bdac2c30517bf26b0fcd457c966c2d76f731dc641", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827580, "uuid": "0db8db08-aa41-47aa-aa71-66a408a5a357", "value": "T1BEE5DBD1CEE0A8AF46019363A8BBD9AE06DBD32E85F7719845548AC51FCCD0907C5ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827580, "uuid": "2a2f2476-f34d-4b96-8d05-36aff1fb3005", "value": "192:IvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvH:fcekCDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827580, "uuid": "3b0b8209-f2a9-478c-94c6-834983a82c4e", "value": 3120139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827580, "uuid": "15b0e84c-f85c-4b4b-a7de-940a503ec5bd", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827580, "uuid": "d72b85c9-9549-48ed-8a30-39cefc66a64f", "value": "889c4f9f13aa21a9eab7008bedd83712.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f140d68f-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806832, "uuid": "a5ba909a-ba9b-46dd-89b0-1a0f4ddce826", "comment": "Malware payload (Mirai)", "value": "6ba4f69d18d9a788fe9752d5898bd16d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806832, "uuid": "46fddbbf-f6ee-467f-a76f-b6b099197879", "comment": "Malware payload (Mirai)", "value": "d852d4987f0d8c789b13ed0c473ddff7edb12ae6716886783089fe5c194c236f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806832, "uuid": "70cc8f02-119b-4e04-afc4-46dbe49d7f29", "comment": "Malware payload (Mirai)", "value": "185bcfc2f71a8f9b079526b262218035af9fce6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806832, "uuid": "59efa3de-9cff-4ef7-aa0c-419571a2c4c2", "comment": "Malware payload (Mirai)", "value": "854a518c9d948faf1eeba4a95ef07d5f5924b587b2298a5f55c2ccc41e4fdc31a63b6b89fa586b8f2172af3c95ab87a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806832, "uuid": "8c0f664b-1969-4bc6-ba05-fa0281bb39d6", "value": "T170736D19E23E1B16C0D0A47601AB875371E11BC95654DACFBEB20E5FFF722A41C12EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806832, "uuid": "eed29d60-8b67-4e03-910f-030f0b7de52f", "value": "1536:w9djNdx+m13k1rhN2Ze8uweMEHkdfdqryddjj3mr4oXuP:4NsoWIFq+ddjLnoXuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806832, "uuid": "58a43665-d669-40a2-83d8-5361dac54cf0", "value": 78080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806832, "uuid": "6ef16f59-c6da-4783-ac6c-ad1eba195af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806832, "uuid": "f63ef1ac-9f40-4a5f-824c-974978dce94a", "value": "nuclear.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e45daa-2291-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1773814279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814279, "uuid": "a4bf4682-137e-4118-991c-c558d7878c1c", "comment": "Malware payload (Smoke Loader)", "value": "8129057a06b3afe69ea6c02b6457f1ce", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814279, "uuid": "053e5111-7b49-4ff5-84de-dde27ccfa0ba", "comment": "Malware payload (Smoke Loader)", "value": "d8bc2f89c4ca11e6c36a033c07497be779b51b4f49c0739436db5c738b338940", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814279, "uuid": "13407aee-f55b-4e24-93ca-fb023562e0b5", "comment": "Malware payload (Smoke Loader)", "value": "7bb99bc8a9119e1324f8a6500dd2652dfa6845e3", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773814279, "uuid": "d15787e4-2c12-44ee-890b-6707b736b94e", "comment": "Malware payload (Smoke Loader)", "value": "03462ee7d761659d81dd0a60dc242193dcc752738dc07661a57e0ec8261d6bac0a7128bc8e8b82dec5800c3d46c381a6", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814279, "uuid": "fb490f59-121d-435b-accb-6f631653e215", "value": "T155A55C17AC9149B9C0A9E331C9F25292BB74BC091B3223D72FD066783FB27D06636B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814279, "uuid": "7254a66f-06fb-42f2-a83b-0e1efa5837f0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814279, "uuid": "7748bab5-bf6f-4510-ae3e-709b801aab85", "value": "24576:zFVE2pVi0LKmjy+uHzrIMRb1QeXWJIXhG/DWYZMK:zFVdpVAmjyBHzZb1QUPXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773814279, "uuid": "e5dd7b8b-b86e-46b0-9892-3e5bab6b14b9", "value": 2238464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773814279, "uuid": "8026fd82-924f-407f-b0bc-a2161f62d311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773814279, "uuid": "97b0ab16-c120-4246-aa8c-bb7fe85f281f", "value": "Daichel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efb7e55-2272-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773801030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801030, "uuid": "6d69665e-af2e-4b07-99f8-12366a711b50", "comment": "Malware payload", "value": "a5054bd9414e6426dbcea5002dd68c57", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801030, "uuid": "40c122bb-5d47-4b53-bc73-51b0a8810813", "comment": "Malware payload", "value": "d924b2a40dd826c90a115240bac6eba1edbc725adbea5b2fbe193e0facd90e55", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801030, "uuid": "562bd39d-b115-4e5b-a579-243d0f44b2ba", "comment": "Malware payload", "value": "0aac33584bf4c928d9aa570fe256b66fc9ea5a90", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801030, "uuid": "87ebea81-eb56-4ea0-9a1a-13e5e9e04a75", "comment": "Malware payload", "value": "876204063be15ce6748b609aa5f4092d3978ee37b88bf02a43f7e584dc13823394169f13bdab3e7d5796ee54eb263c61", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801030, "uuid": "4dabd37d-5ce7-4d63-bc02-37f193095469", "value": "T14F925C6916496C79BBC0DE7D9F3C7F0CADE8C1C02218A3ACBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801030, "uuid": "ff60c20b-1de1-48d7-bb54-eb8ee523b72f", "value": "384:tz0M3vgRjGlsaq7RzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:tXmjf1zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801030, "uuid": "5ebc81f4-c765-4f4a-939d-65ae6a6c3703", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801030, "uuid": "76da0acb-c9c9-4ade-8180-1bd8b7f84367", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801030, "uuid": "22236748-a344-4314-a0ab-3d408c28b803", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb097eb-22a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773823575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823575, "uuid": "dcf5d322-6f52-484f-a421-290481876d62", "comment": "Malware payload", "value": "6babe2247ae72e79465c292f34ea6bd8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823575, "uuid": "c6fc7a6a-d0d3-4380-9d31-f93c47db8c6a", "comment": "Malware payload", "value": "dae7290a2fddc46b2884b7d927caa9fe6591e2a3ab723a26a9f43517266b6b18", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823575, "uuid": "d9681b3f-8b8b-4659-8abc-afaaee383ea5", "comment": "Malware payload", "value": "163b74b614069f2e089a853a507652768e649837", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823575, "uuid": "dbefc516-80b8-4453-85a0-7fd871d9f042", "comment": "Malware payload", "value": "60fea237c4392cf58ab9f733970d4a50aae475f792e25e78730770027c0dcae3b259dd48c362017b16427f781bf5f091", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823575, "uuid": "f458145a-6fd2-4564-ac74-0ccd9cf90e27", "value": "T14CE02B11231A300F8ACB81929908A0DBEA4DC2EC0326FAA694C8AC401C403DA2B1E108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823575, "uuid": "aaed76f4-5051-4133-9a2b-2ff6bd2bd5db", "value": "12:wbYVJ4JFHYtA984CXLgyaIS1PKC2ALFyGHDfh3NQ1MnG3Nbk1N:wq4jHlEXLw1PKC2kFHDFNfENon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823575, "uuid": "65ed7f47-691f-4684-b530-19e668c058b9", "value": 429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823575, "uuid": "2a221b82-e1bd-4ea2-a8c4-c183a58b068f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823575, "uuid": "6ab1d6c4-9268-4ab3-ba8c-778298521445", "value": "test.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe00b15-22cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773840948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840948, "uuid": "760b3d48-85d5-4d9d-8593-5d6ad066a5f7", "comment": "Malware payload", "value": "eba0b6883b6312c239574df77ec925cf", "object_relation": "md5", "Tag": [ { "name": "151-243-109-239", "colour": "#303BEB", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840948, "uuid": "382dc9da-5e1c-4bbd-b718-391f9fb0be94", "comment": "Malware payload", "value": "db1c386e762b8458293c43e8486df5335414246fcc7d52cac75670f8760704a2", "object_relation": "sha256", "Tag": [ { "name": "151-243-109-239", "colour": "#303BEB", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840948, "uuid": "d33cac0e-6ad7-4482-8591-600bec219996", "comment": "Malware payload", "value": "27a3c480930b6cf24d24b0585c539c48074a8f5d", "object_relation": "sha1", "Tag": [ { "name": "151-243-109-239", "colour": "#303BEB", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773840948, "uuid": "000e94dc-859e-4556-8936-c560b31dfa01", "comment": "Malware payload", "value": "efa4443137fadca5e702553b1d363f103a0b601d900729be33ee5c4beeaa71aabd48b160a62950bb35a740f141a0db22", "object_relation": "sha3-384", "Tag": [ { "name": "151-243-109-239", "colour": "#303BEB", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840948, "uuid": "4028c0cf-6985-49af-a59b-998714f15c8b", "value": "T17CD27A1037E2870CE2765E3EA9BBA2428966BA5ADF35D74C0B15940D1CB1704D86BF3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840948, "uuid": "8f9987b6-44f7-4afe-aea9-dcb07f141bb8", "value": "12:8d/Ns0od3OcVURSUy4Sd3o6dcs8XEd1niUAXYgkKPkDvBF7lOJSnXqlhM6VhmNCe:8d/NK3AKfq2iTx6pF7/n6rxmN4CsnPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773840948, "uuid": "46cc5f3f-53d3-4664-91d3-2ea5b5b2e30b", "value": 29197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773840948, "uuid": "6e978090-bfff-4b91-9b57-ba197bfc397a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773840948, "uuid": "57bc3bf2-810e-4340-ae31-b366571bac98", "value": "Dodatok_1_do_zapytu.xlsx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56deda8d-230e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773867991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867991, "uuid": "e66a0de0-1e28-41ba-8b86-65561c1ed25c", "comment": "Malware payload", "value": "4609c7e368ba19185be92744e521d22f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867991, "uuid": "f053db1a-c013-4463-975e-b699a09679e8", "comment": "Malware payload", "value": "db58711c9de179ee34458622babe9815fbd2665913eabe6b2f60c65d6bf5a692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867991, "uuid": "f5fbb9be-7758-481d-b701-f1ef3a43edd3", "comment": "Malware payload", "value": "83a420730761cad357ba003e42dba4378b5db82a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867991, "uuid": "0b78e856-40ad-4530-bf06-fb96f172ca37", "comment": "Malware payload", "value": "b944d69d85a3d0c63dbe459d1672864b0587e62d257cd69dc1940641b792092c52e70266bc7bb33b43f63326df6dd8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867991, "uuid": "c96d723e-38fa-4828-9713-3f21f6a6ac16", "value": "T1F0358E3ABF9F49EED82CF27D4042E093DEE05A2C629845DE5BE0311BDC79DB21978146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867991, "uuid": "c697ab47-04b8-40ce-8ca0-543f00fe269e", "value": "9b41fbb4f681bd50e69d6f0a1ba2802c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867991, "uuid": "dd3dfc33-054c-4637-b936-ef21cc60d01e", "value": "24576:dBF357s5jczkbOEsel7REJ3dchXgs+mmot2+NG4759oi1HwYoxBFEdzyZQaWBfUw:IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773867991, "uuid": "1c60c163-5fa6-4ca6-9b1e-c79751a3de1b", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773867991, "uuid": "a6ee58d1-4f53-4514-8f2e-36b788fc515b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867991, "uuid": "10b88602-724d-4b3c-a574-2208d6750d2d", "value": "cmutil.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89298b52-22cc-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773839729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839729, "uuid": "dba25f7a-1575-4e06-a1ad-a3bfc6bd4537", "comment": "Malware payload (XWorm)", "value": "9874e6211b3692dc764c83a7763d2f8b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839729, "uuid": "093a2523-3adc-41ad-b342-456206478bc0", "comment": "Malware payload (XWorm)", "value": "dbd974fc44b381e3ba85b3d2a5e861b80aa69ffb2f6166535e05c203126e6abf", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839729, "uuid": "0c3740f8-6841-464c-9585-46ceeea90717", "comment": "Malware payload (XWorm)", "value": "55ee8b3cd1158b0454af5982fd0f8e0abb203287", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773839729, "uuid": "5327b5c0-c768-4117-9116-e512545aaaa0", "comment": "Malware payload (XWorm)", "value": "dc05fc7f0ee194fbe812c2a8fc48bc22928f07d66daed262abca3035d52dbba54254aaed4f780e28c57a0fee468b2989", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839729, "uuid": "417fec9b-49cf-4c51-b0af-6faa82332f5c", "value": "T172E2BE042232816D51EBED774A16141799312E37DB37B8AD52E07F6B88122BCCBDAD4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839729, "uuid": "54484c1c-ede5-49b0-a2e4-d602cdd97103", "value": "384:beABK1fKoOv6zaa2CbkPACIULTeeoEz1b0PlxuVQ5A8dHypOMc+Fyv8emg27sn39:bkfOGm7aezz1bAxfHtN+8k7sn3UHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773839729, "uuid": "82d97099-2020-4d70-9397-4583730cf8fb", "value": 32836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773839729, "uuid": "0069afa6-7257-4c45-9766-d0a74568b33f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773839729, "uuid": "e162917a-d548-42d8-8825-af4bc5ce6705", "value": "Raiffeisenbank.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fec8119-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773826453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826453, "uuid": "59487b79-7f16-4d85-8628-f6e235a11fe8", "comment": "Malware payload (PhantomStealer)", "value": "b6e0129a6a77643f727b60e9320c7ecf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826453, "uuid": "ab6b5656-3310-451a-a481-c983e53799d0", "comment": "Malware payload (PhantomStealer)", "value": "dc726496534f7a9b69beb26246b62113306bef14fbca9bf547a8c38663464f54", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826453, "uuid": "4942b460-b09c-4628-a2a9-fb0d13c99b9c", "comment": "Malware payload (PhantomStealer)", "value": "9f705e42b598dba0db635083b823c270fda0b27d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826453, "uuid": "146abb6a-52ad-4c45-9620-bb80dc7e78cc", "comment": "Malware payload (PhantomStealer)", "value": "2338a7f46f7210fc4db1c2c30884fef8ccabaa3024c2709555be9806b6939ae00a005b54d620cf8dfa99d70644b30467", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826453, "uuid": "6f6e8546-d0da-45f0-85f5-f6224cf475fd", "value": "T16F42EBBEC5E1BCC04B5B31D138AEFBC6119E8723BD675B5CF6D804610B10299EB79588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826453, "uuid": "ed6c473b-88d7-4e5a-9152-939ddbb176ea", "value": "384:Q8c3qq4Hk34yfR4wUBvxKOGqkp/o8witzzU765MElB+6bI:Qb3Z4EHiwUH9gvnU7fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826453, "uuid": "654579b0-9a83-4af0-96cc-ee20bef752b9", "value": 12680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826453, "uuid": "746404eb-4733-40ee-b5bd-080920ff7c99", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826453, "uuid": "c0555b25-ef7b-4dbd-94f4-97e049435f42", "value": "b6e0129a6a77643f727b60e9320c7ecf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961ae7eb-22b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827725, "uuid": "22b69c6d-fb10-4e62-9215-e6e40246e096", "comment": "Malware payload", "value": "0905823610d78d4f67f211f9095d4548", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827725, "uuid": "34603156-cbdd-4e08-8224-7825dbb33fbb", "comment": "Malware payload", "value": "dc7b0384292fc416877c3cbfe84c0fac257c1dc084ea33f6e7b59c72f24121fc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827725, "uuid": "0d8b7ea8-766c-400f-9929-2cd118f780e8", "comment": "Malware payload", "value": "df0e6cea37351419f3e5b40aa6b5baf84bd6d0a2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827725, "uuid": "2d04ecd9-5df7-459a-a054-bae4f535315b", "comment": "Malware payload", "value": "3e1db92779925315cdf9f95da93e21128f5b4c9788328a2bb5b5f8762334db42c48e9c53469ddfc5394326c9b59091a9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827725, "uuid": "b8d62eb9-a0fa-46b7-a5e0-40495fc7fac1", "value": "T1DE416B9333D80FA9B54419E510A9311784F6E92E3F362589EBE3166BF83D5B17CA8730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827725, "uuid": "0c2a2aac-994a-4e99-b1c8-28c88b78f728", "value": "48:jcQuTvUzYpBhw2rId0rQ3nyOrC/QIWQ+kQ0/nrg7pvP/PubQ2cTRN:jVozzrYryOrxKvQ0PrinOKTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827725, "uuid": "bc36551e-23a6-4e58-bbdd-25112e21c8be", "value": 2076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827725, "uuid": "aaec502b-8325-4ae0-950a-439ea08337f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827725, "uuid": "d3613a5a-395f-4db5-80ef-da0326b3017c", "value": "zoom_update.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b899b763-2314-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773870732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870732, "uuid": "8b35bed7-055c-43a7-a88a-ed2b6d8085ba", "comment": "Malware payload (Vidar)", "value": "a3e346a25198f2d3d18caf0587515239", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3306", "colour": "#5E9711", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870732, "uuid": "5a4acb3e-9d82-42b8-b721-7eab2e41a76c", "comment": "Malware payload (Vidar)", "value": "ddfb4b9b8feb74bea278e7320aa66417823cfb7f3853322ba5f6e33b00e9c08a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3306", "colour": "#5E9711", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870732, "uuid": "1608e160-48ba-43e6-8156-5b2f4751fd2e", "comment": "Malware payload (Vidar)", "value": "fd4cc54451a0c84df3fc799efa7dfac5044c4668", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3306", "colour": "#5E9711", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870732, "uuid": "550ba92a-169d-45ab-81b9-172e5900a9bf", "comment": "Malware payload (Vidar)", "value": "fa4e162885457627673dad02cf21ff354ef6c496d1f53c480b71f92f8804c1cb50225a1a8af2c1c4a52c41eea97fe779", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-3306", "colour": "#5E9711", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870732, "uuid": "82f4d175-5ed1-4e30-b556-3a10a6571de9", "value": "T16007338E4F28246CB3B53F1A5419DAC3D9E0F954C5F8794F0ECD6B9B2BC86272661087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870732, "uuid": "5650d134-842a-4f21-a882-d838090e4d17", "value": "393216:BwNCBTd5B739kxj5vR6t/sTgFN8ZxqPnBhZhq6H/QfYc7cgdRApX5XhR/0:BzBTdr9kLvR05FGE+6Jc7j3Ihrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870732, "uuid": "fc61458e-05c6-4839-8904-4759cf0df5aa", "value": 17161971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870732, "uuid": "6b511393-eb8f-472a-8822-4a21a82fb421", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870732, "uuid": "5af3d4fd-dbca-4a4e-8eb7-35b00aac451d", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85775873-2304-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1773863775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863775, "uuid": "2a6dbf20-ee43-496b-a976-f3608e72d98f", "comment": "Malware payload (EternalRocks)", "value": "31354feac79641ca4583241254611363", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863775, "uuid": "ef1be238-b117-4657-8a2f-5785ae7cfa19", "comment": "Malware payload (EternalRocks)", "value": "df2db25046baec03fde1d8e8ee145c2271dae2b3759ee26b325c54fd7d0821af", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863775, "uuid": "aec5e569-2241-4018-aae8-9e301321739a", "comment": "Malware payload (EternalRocks)", "value": "da039d6e36638301e512a4e70f3bd5d82491a6fd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773863775, "uuid": "d1ace848-fdbd-4b0c-a1e7-d0176fedde92", "comment": "Malware payload (EternalRocks)", "value": "c792a63650822193c49e7095e46d29b667a0850351a08db7d73e1ddb93c21236dd294959f15747c0990263da03334c75", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863775, "uuid": "ce141520-cbeb-48ea-9b13-baf7cf2c928f", "value": "T15D85335933625224D04B8273593BEBF8C6F7FE8349EA10144EAC7AFF95384E6452C4DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863775, "uuid": "7f46284d-ae0a-4a48-aea4-a70f2166da31", "value": "49152:V3/OMPbCVa5Gx8AmPvx0NPJrn9wVnAf+1wrukBx4xxUJ:hFCVag4PgwWf5rV4xxUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773863775, "uuid": "963c37ec-3e6e-4102-8034-3fbafbb8044d", "value": 1736704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773863775, "uuid": "fa051e92-600a-4441-9d15-c5d1c4aae26e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773863775, "uuid": "cb168956-a74b-44f5-b5c1-0d3f31303b3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5352e9-2262-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1773794100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773794100, "uuid": "f3121f9e-7133-4424-accb-1bb48da9ffc2", "comment": "Malware payload (EternalRocks)", "value": "f1e0725b71461311f518c0588b0d427a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773794100, "uuid": "7fbe01e8-5191-469e-ad4e-2985a7457984", "comment": "Malware payload (EternalRocks)", "value": "e0e14fef475c7cf9503913c801ee4d31b2f7f5b899a4b92f766cfdb21d3edf2b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773794100, "uuid": "f22309a3-57eb-4884-aea0-09d5f942c0d5", "comment": "Malware payload (EternalRocks)", "value": "2b867280d1f71921ba01f3c4ce7120cff76699fa", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773794100, "uuid": "b1c3891b-0e64-4ba1-af11-13da8026e799", "comment": "Malware payload (EternalRocks)", "value": "a9de582b8f9ec47061d19a0109470e80d46ce2697519a96cda51e521ad6c4c066f61f5caa2739774c8175b0195b1a711", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773794100, "uuid": "f03f268b-5d50-4523-9b0e-b2837e2e67a1", "value": "T1EC16330EB581CCB9CC42EF305A090C2D96D0CD9C4D9F9EFA7995F7E186B2F284AA9514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773794100, "uuid": "b248e94f-0277-4a17-9b7c-c6ef2da681a5", "value": "98304:PnZfOhlwtvftmPF4t9LbnphT7t7vpQbQyXifMejnnH:Pkj2tmKr3T7t7hQb3XifMqnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773794100, "uuid": "ce65ce4f-bc75-4208-bc60-f54775733036", "value": 4231168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773794100, "uuid": "c8c3b9d8-52d9-4a34-90b0-57dc339ed487", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773794100, "uuid": "125d76d4-2c00-48e6-9054-bc187048c9c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d7e8a5-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800956, "uuid": "43d5482e-326b-4b67-8b02-b3015abfb44d", "comment": "Malware payload (Mirai)", "value": "f3abd5b9387094046079b2f21e3feef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800956, "uuid": "c7008c2a-b166-4f4a-8807-145eb45acc3f", "comment": "Malware payload (Mirai)", "value": "e0e170fb4ccbd24e44591435189b36f3301095e5511a5bcf4655087848e8d69c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800956, "uuid": "5a6867cf-1222-456c-8c88-16a435ea9a0e", "comment": "Malware payload (Mirai)", "value": "a62df0ff7524e19e4b196b14d31b6e77ca43b174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800956, "uuid": "5aa0c9a4-41e2-4942-b9a2-94ee9b328a91", "comment": "Malware payload (Mirai)", "value": "7e9a280ce8a7d2a4a645c4cca2531758e74546cc00c8b4e57bd815961d5622655e0269e1f7294c69bb40a6d344963949", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800956, "uuid": "d00bb68a-b909-4576-aff3-771beef3ce48", "value": "T1CBB2E139F4A42EE5FDDFDE300F84C3816B965F5EA7928AF2209ACE92570B472E5045C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800956, "uuid": "bfbe8f61-ca4d-4a79-a2c5-f878d8632980", "value": "768:UZxaajVrnZHKP+UhFRGSaUJ5ez4uVcqgw09l:QaajVrnZq/Gi7g4u+qgw09l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800956, "uuid": "417f78c3-95c4-48d0-b800-536e87cfbe57", "value": 25520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800956, "uuid": "a4990086-f918-47b3-95c2-0f61f4c30b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800956, "uuid": "d46e9848-2175-49e2-9803-acacb56c79b2", "value": "dontcrynow.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e6e0a9-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773827193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827193, "uuid": "e039f3b0-fe49-48de-87c1-2f97b57ae999", "comment": "Malware payload (Formbook)", "value": "e32950cdebffda0499161715dbc167c2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827193, "uuid": "8e4076ec-2e38-4b0f-8f31-10b15745cdc7", "comment": "Malware payload (Formbook)", "value": "e112330656ad337612b9e6e468af907b3b8cd11b49de07aeeb3aa91db54acbd3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827193, "uuid": "942e25e9-ef4a-4ba7-93af-248c5c866d4a", "comment": "Malware payload (Formbook)", "value": "83fccd269b80f5704c9946c77f33fb0fc0654ef2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827193, "uuid": "ebd7b604-83bc-44b9-9af0-0ed5fc29d7b6", "comment": "Malware payload (Formbook)", "value": "b402618f38eb518a97b03715899aa0908a1d2ccd32f34d059780b5b4e983f6e2a6dc28d2696528f0f69fddbe67b2520d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827193, "uuid": "fc65c124-3832-4be0-a129-c735520d8b15", "value": "T1FAB26DD4CD5B7EFC096A22148DEEC164CBF441127805C461B89FE31AB31664CEA75BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827193, "uuid": "f86d7cd2-cf4e-4a87-bae2-ad527d90edd5", "value": "384:YVpXc42AyC847foFCDJf9Q4/Hq38OiPi+ltAOnpMxfzDvTzgBv2Rr7lzlSVHJ4:Y3XyK7fisQVi6+UOpMxfzCybYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827193, "uuid": "ea2e5478-5b15-40cf-b826-aeebc1d96ef0", "value": 25318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827193, "uuid": "0ca4d609-2243-4f18-9f58-db4df38b6065", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827193, "uuid": "3b9e7776-4b2b-41bb-a0fa-3994d255b5cf", "value": "e32950cdebffda0499161715dbc167c2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9e0271-22e4-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1773850232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773850232, "uuid": "972ee7b6-20ff-4880-b87f-a6f573b748f7", "comment": "Malware payload (KongTuke)", "value": "f2a25274ea39301651d5291f6f83b7ea", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773850232, "uuid": "4b97f57d-a0ca-427a-ae4a-2b7628f84163", "comment": "Malware payload (KongTuke)", "value": "e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773850232, "uuid": "034a745e-6809-48f8-8e23-7dfcbc73219b", "comment": "Malware payload (KongTuke)", "value": "7a04209d104af348474df5bdea9bc0c9c76be9d5", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773850232, "uuid": "a2d56425-7eb4-453a-9dd7-ded8aba3f964", "comment": "Malware payload (KongTuke)", "value": "6f444b37787d6a4cecb2abe8399664f96a78118975a70be39b2dfdd0b6315d1a3357eeb3ab2c945e8cabe9d6f4f2f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773850232, "uuid": "89a853e2-fa18-431f-a5db-91ff8832b18c", "value": "T14046F79EB64407F89994ABCD430731CE63A285372EBB104895E2864F7C2EF1376B5D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773850232, "uuid": "aa7e9a84-fa63-4550-8b91-b0606189be35", "value": "24576:TqmLhriaw622zvRrdmdvmdvQkdvQ3+dvQ3aifdvQ3aibEdvQ3aibk2dvQ3aibkjK:2mLhrRzvRrwojtmNQvePtV+cwJCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773850232, "uuid": "29316397-0fe9-4177-b289-50b2f983f3be", "value": 5604610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773850232, "uuid": "dc529f82-240e-4548-b597-54ce6428c2e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773850232, "uuid": "edf7c228-b96a-4e0f-83e1-7e78e694de92", "value": "search", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bfa6d3-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773825194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825194, "uuid": "6ed4ddcf-07b4-4266-a67a-718c24516513", "comment": "Malware payload (RemcosRAT)", "value": "5510fc7bf1fbad0ff9589e7808f3c49d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825194, "uuid": "4ad6d7b3-ef6e-4568-a0ea-3495b33b9087", "comment": "Malware payload (RemcosRAT)", "value": "e1b7dcd8e820ad257729809a1707caafa2981c111f3c6af965572c163be3feb6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825194, "uuid": "115861d5-f9a6-44c6-b517-04487432f23c", "comment": "Malware payload (RemcosRAT)", "value": "17423ae28df3521df664ac6a5caa6769dfa6ce55", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825194, "uuid": "0be20b9e-153b-40ed-9c33-57fa976111d3", "comment": "Malware payload (RemcosRAT)", "value": "a8ab27c38e318d4c997ceed02979a790dbe96f5352f436a89fded71199590e5c9d2d8bdfe4b6ba672256c83d00f914ee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825194, "uuid": "b91fba80-dd98-42e7-b479-1599607bf6d3", "value": "T1595412157195C90FD8872EB06DC5F6DBD928FDA3AD938A0F38C2330D4D795C39A06896", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825194, "uuid": "04695a8d-11e2-4e72-9296-edfe93b0439d", "value": "6144:CUzgETg7SN39ac8YZ/Ed+aeXEv//Ramk4Fb/HMLnl1ftAU:CUxE7Swk/Eh4nAQLnllt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825194, "uuid": "db56fc34-d824-473c-b942-f04831094829", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825194, "uuid": "2cc39c84-017a-45fc-b772-1f4e26303e6c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825194, "uuid": "cbc10f0f-b614-40bb-82b1-e441460ce114", "value": "5510fc7bf1fbad0ff9589e7808f3c49d.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1b867c-2311-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773869317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869317, "uuid": "2a10b167-000b-42f8-8bee-ce4517f5149f", "comment": "Malware payload", "value": "70df2f093d5c35194c29c344e1c4ceba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869317, "uuid": "8bb316a6-37af-40d0-a38a-554b9d3c7469", "comment": "Malware payload", "value": "e2c51f1733baf02b7de6cf095989a30167375c04e0b5a4c70fe0c4f9f1585c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869317, "uuid": "3d5d0c62-cce7-4f7c-aa57-4524ca928fbc", "comment": "Malware payload", "value": "ecfcf89ddbbc6843d044e41e6faeae8be66e9248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869317, "uuid": "6913cc40-5ea4-4cf4-ba20-a59726a86182", "comment": "Malware payload", "value": "a1d880324bf590971017b8718bb6342bb73c8ba6b3942281de0aa29b3cea1d17e7388b06fedb75b9a936bd93afff0a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869317, "uuid": "56a6cb9a-f31e-4518-8bc1-0ba52a148f6f", "value": "T1F285F11927EC5A98F4BFAB78C4B5841187F5FD07EA31DB9E7A84509F0832B418A52733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869317, "uuid": "7a7998eb-2711-45af-b16a-5034a840c748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869317, "uuid": "0a15edb9-0b6c-4b62-bae2-61d5d67560e3", "value": "24576:602E0KR7KLLDPQ2eR0/eS9BrVXqI++RvwavQo:SKR7KfDPoS/pVaIjFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773869317, "uuid": "1932b7d0-9f1c-44f8-b8fa-54dc13ecb602", "value": 1773056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773869317, "uuid": "6780fe8a-4cdb-44f8-9aad-9a3d52170a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869317, "uuid": "29d5b17e-4349-4e8a-919f-d2910c56d8c5", "value": "#Purchase Order#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d2d8c5-22e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773848817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848817, "uuid": "395dfb3c-bd4d-493c-836c-9e40a2a5fe7c", "comment": "Malware payload", "value": "1d6bb69d2fd0cc44fb6c1ff15a833dba", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848817, "uuid": "0b29ea70-6a48-413e-8990-2a86de1a6595", "comment": "Malware payload", "value": "e2ef852e00bf3213256de557660e9213b24351f3defc93360688c0179bce1c3f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848817, "uuid": "bc348354-a45e-4d8c-8af6-21e6198c8f84", "comment": "Malware payload", "value": "275578e60f7ff6936d965e7ee654aec2fe18716c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773848817, "uuid": "9fc85033-69f1-4d08-ba0a-ebef98ca043f", "comment": "Malware payload", "value": "f6a1b83c016c2589c589bf8c19d318213582eec528a26a7212b50c30c112f9c6da4e8714e583c424b95fe48357233fe2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848817, "uuid": "b551ce30-2d22-43dc-9304-e18f933615ce", "value": "T111A73331728FC635E18E147BD869EE0E90747DA7033042D7A3B97D9E1A728C16A7DB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848817, "uuid": "7d2d5c79-a7d8-47e2-8936-feaac05730f8", "value": "786432:6YFlMoermdRCmyE+f3AozmNth0eaboRjsL8hjbEA3MYx47yLFeOpeqhf8lqS:6YHdiFmyEGQozo/RjsL8FbEA3MYxSKr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773848817, "uuid": "067b5a06-f56c-4332-89a7-f2f851f846b8", "value": 44097024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773848817, "uuid": "4338af56-30a0-4556-b5d7-6fbaab59f59c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773848817, "uuid": "c62896e0-2429-4a31-a1f2-9617ad0ca2ca", "value": "Kfailin.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1ba90a-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773827275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827275, "uuid": "d288ec1f-730c-4745-8c64-22785b5e570f", "comment": "Malware payload (AgentTesla)", "value": "e136deee5bb977af27571f718cf5af28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827275, "uuid": "adb99c20-3230-4c7c-905b-caff5976df9b", "comment": "Malware payload (AgentTesla)", "value": "e3a56faf20114114741209d2ec8c368c61b79bfa2ff969150ed8323aa0263ab5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827275, "uuid": "621fe667-2379-4272-b3e3-8a5f9efe77a7", "comment": "Malware payload (AgentTesla)", "value": "1659955572961193ac79310cf8cc7269d06dd4e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827275, "uuid": "aac47818-1285-4cbb-9704-da319a6f78a1", "comment": "Malware payload (AgentTesla)", "value": "5830ad95dc98c13e2abf890ad256f387546109ea937c6ca69a59b8a8b0aba721b35e8e4ff0e3e01bbac9f815b34e2ee0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827275, "uuid": "618e848c-2f6e-47ec-822e-4ada11b73ff4", "value": "T1F34512FC43E018988C371986FFE64B6CCFD8C51242A7BDAD90A1BE87900575AF37A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827275, "uuid": "415563f3-75fe-4001-98af-d6178350d743", "value": "24576:A/ay75j+Bzxt6M4Ju0lY012/s8s6046Zva/zliC5fc6Rry12/sz1+58TSUlB+wac:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827275, "uuid": "3d47e7d7-2627-42b5-83de-541d23902049", "value": 1204759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827275, "uuid": "04917a24-af18-482c-a7af-74472d67a0c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827275, "uuid": "2474ec2e-582f-47f7-9afa-060df55c5ac6", "value": "e136deee5bb977af27571f718cf5af28.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f89f6eb-2311-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773869214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869214, "uuid": "f893df47-bd01-4bb9-b5f1-bef9a22e1bf9", "comment": "Malware payload (Mirai)", "value": "4038eb271820b1e80a7d79e52ae7f176", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869214, "uuid": "86f7724e-f46f-424e-a51d-7068a6751e38", "comment": "Malware payload (Mirai)", "value": "e4b5740a806c79b10a608332c6a1099780303b0b82d3b4be122734af28ae8314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869214, "uuid": "876a0eb7-b9a4-48ef-8ac0-895ae351e84e", "comment": "Malware payload (Mirai)", "value": "12948e02b5140e48e8e6a033a0960ce554f5a0f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773869214, "uuid": "c3da7ef8-b48d-4622-b9ef-2b9da6d36949", "comment": "Malware payload (Mirai)", "value": "b1eade64c88cb9c79b464050d422ba12d5e7e7a018f1975b57763b4ec263f3e7af6c3ff444e8a09fb9317dfc887ba3ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869214, "uuid": "0121a3fe-037f-4181-bc4e-65e1665fd24f", "value": "T1CF93BF22D8286ED4C1944A34B8F5CF784733E45081972FF359AAC2795447EECF6687B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869214, "uuid": "7f90056e-097f-4c53-a12b-9cf77d998646", "value": "1536:xAdflTkGvvMLU8pK3Pna8MMTnuUqarg+sf8guK6lafFvsPCXlRc9s++Z:xOFL8R+nNSUqsgnBB6kvsP0Caj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773869214, "uuid": "a31bc411-d5b9-4311-b5d1-4d0b966ac32c", "value": 93200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773869214, "uuid": "ccbcf10a-45c6-49ab-ab11-af6cd15832d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773869214, "uuid": "d0724b63-754f-4762-ad60-243c606a49b6", "value": "tux.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013e3fc0-22a7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773823610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823610, "uuid": "79bc9d6e-433b-4f82-8248-d44645423486", "comment": "Malware payload (AsyncRAT)", "value": "c6d858aa813051d68bcd51b4d68047ae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823610, "uuid": "1a2b9fa3-c8f8-40ab-9a2e-10cbf7af5fd6", "comment": "Malware payload (AsyncRAT)", "value": "e63b6b875326bad1c16a3b079e02a83daf2c73a5c5bccc67a891b6de6c09d84f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823610, "uuid": "20a26ab9-28aa-4a0b-a4f5-e8cbba198a64", "comment": "Malware payload (AsyncRAT)", "value": "9f354470cec4f7153462975d551df8c32aa79a8e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773823610, "uuid": "81740433-76b0-4442-96e5-32589c42be0e", "comment": "Malware payload (AsyncRAT)", "value": "301b910a9802f55144b63ab207490b10451ae37b7f19c7ad3faf9a67b1427bd4df56369fdf44fbf247391366f4191400", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823610, "uuid": "92b58ad5-bf89-40b4-9bd8-ae40177ec982", "value": "T14BE081211357300F2A9FC0928948D0CBFA4CD2CC03263DF769C4EC018C821E99E8E228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823610, "uuid": "6004fe60-ba92-4489-9f9e-5f85d71957ff", "value": "12:wbYVJ4JF6984CXLgyaIS1PKC2ALFyGHDfhy1MnG9k1N:wq4j6EXLw1PKC2kFHDT5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773823610, "uuid": "f0d8cf51-6997-444c-8f36-c0aa0121bf2e", "value": 419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773823610, "uuid": "0e3923c4-b16c-46f7-9502-97fe341f3e71", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773823610, "uuid": "f00e0a19-17f8-4fe4-9c45-61f1579b4975", "value": "interac.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc8e294-22dc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773846666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846666, "uuid": "48b27a9a-be71-40a5-9d3c-3f179ae7c98c", "comment": "Malware payload (ConnectWise)", "value": "39a44c13ae04802bd6a5eb3aa1a63acc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846666, "uuid": "7316ff29-441e-4226-982a-7f13a256e7cf", "comment": "Malware payload (ConnectWise)", "value": "e641ad9ed0382b31da3394af06142473157470046f044dbb1ff3d1168088ff89", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846666, "uuid": "a053294c-be9f-421a-9dab-b29581dc9921", "comment": "Malware payload (ConnectWise)", "value": "1802dbc79fe1699924fd8b8acbc465d8b3a9a190", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773846666, "uuid": "02e073b9-6f54-4ec8-b4e9-2d9867a0ee29", "comment": "Malware payload (ConnectWise)", "value": "990e62af3347d007e456bc09ddefbefc8f571b4d07123cd61a62fcbe52621868757704940bf0b0f6aefaedbcf2eca606", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846666, "uuid": "a135e820-3783-4963-a2d1-0edc0da8b91d", "value": "T1D7D61201B3E69574D0BB0A38D87A9266AA31BD005716C7BF5794B92D2D33BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846666, "uuid": "027bb521-a6e5-46b1-9f53-6ae725d22a24", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846666, "uuid": "0ab54d10-73d6-420b-be14-7fe59000cc86", "value": "196608:CfefPiBn2hg5kEWmXhcfKjSV4h7vGelBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhc/:mgdEEijRDGKgdEEijsgdEEijkgdEEijF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773846666, "uuid": "e283be5a-1d20-4328-8b5a-93596d75271d", "value": 12637240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773846666, "uuid": "624b7627-0e41-4381-b088-03af39684e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773846666, "uuid": "1cec8757-22a1-4c16-82d2-7bf9cfedf193", "value": "ScreenConnect.ClientSetup2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b172cd0-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773828136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828136, "uuid": "99fc65f3-74d5-45ef-822c-c91d9a3290ed", "comment": "Malware payload", "value": "01e7351a822d248e68fd522773e4756a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828136, "uuid": "237d0be7-a1df-4ce5-96db-caafd627a740", "comment": "Malware payload", "value": "e653f732687ba014e82d9bb6b7ab7b1121379148aa9b6055ac20d34a5e32e765", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828136, "uuid": "35ddebf3-dee6-4881-a196-dfc38f0cee7f", "comment": "Malware payload", "value": "78027708b26f0c14508c09bbe23946a410133a3c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828136, "uuid": "b56235d3-5d1e-4565-aac7-0d474015018c", "comment": "Malware payload", "value": "95f9995a4ff602113d47a8cb4a34d4cd1d9d0c61fd47d275d63134e639df1a9e26a4df1e97e1d6507952bdbc57d2ce76", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828136, "uuid": "5c1df882-09f3-417a-8d4d-865009275659", "value": "T1E9451B0C16A9B55CCB7F61B72EB432390721019B1E17DCF8E7E97A1C06A3BD9DC1A684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828136, "uuid": "d5122afd-584b-4217-893a-daf2dbc30a41", "value": "192:pSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSC:evEqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828136, "uuid": "078939e7-0dbc-4adb-b59a-e71ce66bf4dc", "value": 1190681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828136, "uuid": "114d66ae-14c3-46c1-8973-a5b653240989", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828136, "uuid": "fb91bce7-7e24-48d3-b78e-900314c21228", "value": "01e7351a822d248e68fd522773e4756a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3800ad33-22af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773827137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827137, "uuid": "2d2bf139-7d8e-4a9b-9bd7-53fedeb2cdae", "comment": "Malware payload", "value": "6b6c1bfad1ae580513be719dbde74e82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827137, "uuid": "efc5d16e-2357-4d40-b0dc-e90647ae28d2", "comment": "Malware payload", "value": "e6ce9dbf77eb2a75eef7676bed25227d9bb64df8da6aa627cdd70cec0a71c7bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827137, "uuid": "2c31a698-2fad-4a49-b237-fab2aafca157", "comment": "Malware payload", "value": "6cee8facb5d623db2ff2a6eb42b5ca69e0b31018", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827137, "uuid": "904e2227-3c63-4ecf-812d-5586b1f1893c", "comment": "Malware payload", "value": "7360e26a1addae9f4a5ead6415b5639e31a94c83a45489a5de11f398ee2aae96c01e07e8f3882580659f6c6bb0c6fa34", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827137, "uuid": "bd36d5c3-c6ec-487e-a477-7ece4bba7969", "value": "T1DB53DD56016DC9449BDE1833A604CFDC2CC95576ADEAAB61B749E2AF80247CCC7BB43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827137, "uuid": "83ec5939-e4d6-44d3-9357-a0f110463c00", "value": "384:XjjwUCND+1d1nLzUWm54zHgq8yxBg8IJY0TU:XjsdD+1nLpm69BcO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827137, "uuid": "ce73b4ff-0cf2-40f8-bb2f-88304929d2ec", "value": 61116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827137, "uuid": "45dd3a31-c3f6-4698-a19e-808cbc0cdfcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827137, "uuid": "5dbdf068-4e69-43aa-a594-5f875e2ab159", "value": "6b6c1bfad1ae580513be719dbde74e82.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fb0489-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806815, "uuid": "4cca25bc-0252-4701-916f-4a3bf00d27ea", "comment": "Malware payload (Mirai)", "value": "1f93bc5eadade556603fbf11824599ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806815, "uuid": "051f1edf-369a-4d8e-872b-58f72b5c7c05", "comment": "Malware payload (Mirai)", "value": "e7898203a703a72f0a043fbcaed0da9bb17bd23ad1d11136fb6f4e581b14e887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806815, "uuid": "c13b1a81-dea8-4de4-b684-9854b6459556", "comment": "Malware payload (Mirai)", "value": "4c30d5c7652461c0afa99fcf50bd14abebd8d23e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806815, "uuid": "fddf418f-d9db-4c77-88ce-cba0fe257e65", "comment": "Malware payload (Mirai)", "value": "a7ff83ba55721aa03da7c7707a8ed704e5705b3d4dd961374578f313f875f19930a53055aa1e713fa4c0c22094f20c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806815, "uuid": "daf67e2d-c8d8-435b-a2dd-5bde5dddd6fa", "value": "T1429329B22547B33CE9B31878F40321E325220B5C3BEDA1D3B5D3647AEB7460D65A2E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806815, "uuid": "44c16dd8-be9b-4c3d-b3b5-1e75c44828a0", "value": "1536:yq9BfAOTAB6SpcUlwBRWrRj4LIlLwZ6C7URrtKNK:XAOTAIdUlwG1Me4bwT2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806815, "uuid": "15f9594f-464d-4cb8-9a04-d27791135b27", "value": 91768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806815, "uuid": "1741fd23-4998-4cb0-a63d-014e06a6be23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806815, "uuid": "a4dcd863-9ac4-4360-aa84-4ca3c8a77648", "value": "nuclear.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f753696-2269-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773797193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797193, "uuid": "9c8a8748-1da6-4d14-8bcd-4f28c6fcfa27", "comment": "Malware payload (Vidar)", "value": "8e4f5dd371e4faf66e9b66cd557079c5", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797193, "uuid": "b6a0a491-2b52-4d5d-9983-ec1f3ee3862d", "comment": "Malware payload (Vidar)", "value": "e7a48f25eae2d05812ab55f6466e12c4d0e661e667fc25778bff717289987908", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797193, "uuid": "fed28ccf-2623-4403-bb3c-9b4090ea90ef", "comment": "Malware payload (Vidar)", "value": "bdb1a38c61990e58c9a32e423dc748712b6610f9", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773797193, "uuid": "4c42a7db-3b59-4845-a7b5-40a7008ea0c2", "comment": "Malware payload (Vidar)", "value": "25358479e8149701d546401852dd5e64316d436689efe6930c3a4f98118ecc3fe6abc1b933e656ce8eb8d1ca358adae2", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797193, "uuid": "8b38236a-3231-41e9-98b0-87e0efd62bb5", "value": "T1875501AC74B4B856F5D4437FC6842CB6EB2CE540D7AA3D9F8E2081563D8320E5F6B861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797193, "uuid": "2bb7b930-f0a4-40a6-991b-ab4a2f769749", "value": "24576:cXSlc1ksN3mv8y1JXZYC5i+O1YkESq3fJe/lZxoPw3mhXeSvA:cClcuq3Py1L5i+MY3vJehP2lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773797193, "uuid": "ae5ba5c0-42c5-4e1c-8ff4-4692a028a3fb", "value": 1356356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773797193, "uuid": "c7ad4a6f-149f-49e3-b7b2-a61796d60714", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773797193, "uuid": "3781affe-0074-417f-b0dc-a2eaa1df2648", "value": "setup.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d154ee64-230a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773866479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773866479, "uuid": "18732cdb-c62d-4d54-8f13-56ccdc7a8e0c", "comment": "Malware payload", "value": "a1926f1be8f67907ad0050b8b1b04e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773866479, "uuid": "221ab68d-a5c4-4c6c-a5d6-df3d8a263963", "comment": "Malware payload", "value": "e7ab3703410656cf1aa6cd7fcc4cc1fd3b3fcf02a9c662307aeb2474e900253c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773866479, "uuid": "2ebd37a6-d060-4e0c-922b-5256b6412138", "comment": "Malware payload", "value": "ae4a0bf7c19f371962cf4467c5fe3727b5866a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773866479, "uuid": "d37332e6-5b35-4961-b223-9c27d3f029b1", "comment": "Malware payload", "value": "137b0c6085d3ba0be86003db493e2af914bc2b4fa7dc12dc1634bc1bffca7b7ae2ae8576131ecedfb909356394d4a4f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773866479, "uuid": "d6f2028b-284f-483b-b8a2-9b071ccda019", "value": "T104231A90D094ECE972182471C474B651B53D98FFA7BC6A09BC0FC2E7DB8DB124DDA282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773866479, "uuid": "c2dad6d4-4a48-4380-9a4a-ca6669e903c9", "value": "384:uas/tG/x1/0/Fn/l//jOVOQOaO+OZOxgOhOXOYO9STHfwb8yrv7:uZ8LcF/B7ItF9M0g+s78y/wb8yT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773866479, "uuid": "d25b4a66-b71c-4c4c-834e-9b38bb604ca2", "value": 49262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773866479, "uuid": "79a48cdc-7f5f-431d-bcd1-bcacc1771f89", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773866479, "uuid": "1956201d-7390-42c8-9746-cc7ad8fb302c", "value": "greatknowledgewithbestfeel.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef93bf2-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806829, "uuid": "93f96efd-6e90-407c-8333-4ae071a40255", "comment": "Malware payload (Mirai)", "value": "f10a44c26147b88486546758338678da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806829, "uuid": "e3d2ea1f-a78d-4dfe-89a2-c92a40fdf8e4", "comment": "Malware payload (Mirai)", "value": "e827d062c77dff478eea083e9d7f9b0b2814691835ff5af56373705660464281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806829, "uuid": "634facd8-06ff-437f-abfc-7c31a515c202", "comment": "Malware payload (Mirai)", "value": "43bbc27d8b1d919e0b131ed72060d2b1fb5c86c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806829, "uuid": "c9d32f98-09f4-4927-9dbc-6c05fdaecd38", "comment": "Malware payload (Mirai)", "value": "4802dbbfdf93fd2fce9b63ab9f6aad413cbd18b0db91ca938c7ff79e937b154bae8abdcc82d3b4e5665842104ada0c59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806829, "uuid": "b6b15774-c65f-4191-8625-033bf0ba9ec9", "value": "T1D6340B1E6E228F7DF768C27447B78D21975833D623E1D680D1ACD2112F6029E691FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806829, "uuid": "9ebb9f63-d7ab-4892-b6b7-4724cba30eaf", "value": "3072:/Xu2+rCr0B+SbJDQ0YeJvfaLE7uJm3Q9+RfQ3n/PfkXFZKlf3cYRl:OrCr011tjaLE7uBQYPfaZufx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806829, "uuid": "f11cb8ea-0042-49c6-9771-ca07bb64fad9", "value": 249736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806829, "uuid": "11c01b13-7980-4f85-9387-7ddcc57bf96c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806829, "uuid": "8fffc503-5380-439e-b936-48678e2bcce7", "value": "nuclear.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57222349-229b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773818600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773818600, "uuid": "21a1f351-0ae6-4acc-922a-0c44548a4104", "comment": "Malware payload (AsyncRAT)", "value": "aa6520925656316533f71e84b30d5cc8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773818600, "uuid": "8824b336-7adb-43b7-8bec-45006cc150a6", "comment": "Malware payload (AsyncRAT)", "value": "e82b8b4fda78cdd1b1a4455103362ef508b1d903a3de7bb0ff11c07e8543123f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773818600, "uuid": "46734c4a-22ce-4cf6-847e-43a938a26e1e", "comment": "Malware payload (AsyncRAT)", "value": "6777d20bb645a5689d459469f434ae66787464b1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773818600, "uuid": "30be1c99-511a-4977-9ca5-6c1c4c064223", "comment": "Malware payload (AsyncRAT)", "value": "9be33412e4bf82d87a6186e83a00edca43d1c11d61de3fc2962c117f5cad506b56f029363634f11b648a17fa69f68aa9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773818600, "uuid": "a288750d-c3ef-44ea-9ff9-6c2c2ae0e0c1", "value": "T1B405E0056A58E802C5A19BF81870E37442B97D68BA01C753DEEEFDEB75396C634043AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773818600, "uuid": "697789f3-1c3f-4110-9a68-fd7fa66bd9b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773818600, "uuid": "7b06b585-3f14-475f-8b9c-1d7af3351dd6", "value": "12288:FnDYvdFpdcvkI+BciNB6RMZHYivLxPb13hO9uhuwU8daJqPdlTncJ+wbM1gnD2H:F8vdFpdcvkIMciaCZfPLNPLnMh5D2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773818600, "uuid": "148379a0-c87e-4e8a-b5ee-4be267d435e9", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773818600, "uuid": "bca11871-dfb4-4721-b354-6bf8868b23e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773818600, "uuid": "dbb7f22e-860c-4944-a0ab-f3f68a54006a", "value": "T26021001 PL - 1 x 40'HQ(\u4ee3\u7528\u6ac3) ( CFS-CY ) ex Taipei to Long Beach , CA (EMC), ETC 0320 SO#0288.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f38a8b-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851781, "uuid": "c2c088d6-0035-4e3a-995d-2a902a2e9f69", "comment": "Malware payload", "value": "96acb18a5822d462e01261b693f62b82", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851781, "uuid": "c10341a4-f8b6-4d16-9953-02aa071eaf8f", "comment": "Malware payload", "value": "e8c5f71924994f4a98f8247c3f1bd83b46fb5cd47f0365fcbb6dc4b310680224", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851781, "uuid": "54084a15-7350-45df-927d-6677f2b41d5a", "comment": "Malware payload", "value": "eea83359a621d726edd0ecfcd204015694676e95", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851781, "uuid": "a6137d98-7213-4889-8efa-5a912ad126d0", "comment": "Malware payload", "value": "e3a891f008d02d6e6a33bf204d4ba16555fc641f26718c3d9bb0a5f52b623a89cab200b6cb14b737e3aecb0f15b33e95", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851781, "uuid": "103045de-dcdb-42c8-b73c-340a9c78fd24", "value": "T196D6C5F1A86CA3FDD5846781BF5F2E49C49089079842C69893197BAF0124F3AF9B5FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851781, "uuid": "71440e4b-a247-4404-bca3-3d85c1ea111b", "value": "1536:urTtzo8l3OwqNvmFZE4ubQe2bMeIKVc7r0fa3vLn8sR+1v+OczAqx6ZUrUMOGDWC:CVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851781, "uuid": "6440ce95-5ff5-4fd1-a6d4-517c67bd8196", "value": 12727620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851781, "uuid": "4afb47c8-97c8-4750-9085-55e0fbd6dc82", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851781, "uuid": "ab0ff4a6-b795-4cac-9175-f864d8abfc23", "value": "2LazMAR17_hvvvvvvv.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce972dc3-230c-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773867333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867333, "uuid": "d91d46c5-6632-4774-88a8-220cb9b28244", "comment": "Malware payload (ValleyRAT)", "value": "068f75f24254113b30aed87e7759e595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867333, "uuid": "e2506a16-ce99-4c6f-b07f-621f9c1ef49b", "comment": "Malware payload (ValleyRAT)", "value": "e938d2d422b2c1f11c8b25c742cb2510e82f44c6ea1d71a4befefb580ea42160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867333, "uuid": "bb4d6d79-16c0-4505-9d87-9b5f8406a092", "comment": "Malware payload (ValleyRAT)", "value": "77af677761448c45720d5c2a85f5a1ede204009a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773867333, "uuid": "c69677ae-a2dd-4e10-afb1-a6f94f34d7d6", "comment": "Malware payload (ValleyRAT)", "value": "44111c941dd9252da2d9a9bf3a294a521588ef84561dce0b9bf5e456882bdac69ce00e8c032f482a666652a5474fe793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867333, "uuid": "fa143d61-43f5-4cea-b23c-90e552e435ae", "value": "T1AFC36B3DB29334F8D102CC7046E6BABAAA71BF6011156D9D97E8F7372D39C845A0A631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867333, "uuid": "e98c723d-f1a7-4de4-93da-fdc317930844", "value": "fa3f46aba12a32fe8ff2d4397b8cb7e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867333, "uuid": "b7858e38-f5bd-4519-8dd8-6898f3ad9072", "value": "1536:AGbuFK+HZVbJWHbObA/J74UVGu1Ohczgfmz4zsJRSYlA7MJ:AGqFK+HZXWHibAh7hVpO8ZasJwb7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773867333, "uuid": "8e28ad6a-99d8-4507-b662-50681c4ed2d0", "value": 124490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773867333, "uuid": "aa35b070-cd28-447c-917c-75487cd9bc7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773867333, "uuid": "166c595e-d2ed-4aca-bead-2b849683002e", "value": "068f75f24254113b30aed87e7759e595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f18c82-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806820, "uuid": "d5dbb8eb-8e85-4b22-99ec-245c080481ad", "comment": "Malware payload (Mirai)", "value": "f7be80ba920da30c57acc630852e4209", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806820, "uuid": "8c16f305-9050-43d9-9b46-ab9064764a58", "comment": "Malware payload (Mirai)", "value": "eb57bf883da7357f144fc16cb2744cc368d143c5f0e5755f9bf3ac80935cb08d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806820, "uuid": "26dc1138-b135-4995-8402-9767ec724113", "comment": "Malware payload (Mirai)", "value": "22cfbe99a9422f53be955a72df6f3a13e2bfcda3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806820, "uuid": "c23b3230-d46c-457a-9306-ab1740f418f7", "comment": "Malware payload (Mirai)", "value": "777f02086bb1c745218d0ea96120495886e8214ae58305ec62eb29ccfd6f9404fa4c7463515cf6a98fddfe521fd5d695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806820, "uuid": "de6e5ef3-29e2-4e46-af17-578f3a979322", "value": "T13EE32A40F987C1F1D8874C3050A7B73FDA31BA695133C76BFF95AE31DAA7A429112A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806820, "uuid": "02b65b9a-a27c-415d-9ce5-bf29d17e4edf", "value": "3072:eKfYS12LiOFPKDiPY1CI7P9CkFSnzibj89Yjs:VYS12LiOFPKDiPY19PsWjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806820, "uuid": "dc2341ec-b1aa-4dca-bf29-7028685a61ba", "value": 153000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806820, "uuid": "341096ff-4273-4b63-b088-eb545f81f35b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806820, "uuid": "f0d17d29-0899-43b6-853e-28c0e03ed628", "value": "nuclear.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7972466-2313-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773870382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870382, "uuid": "41d4acb1-87e9-4219-8151-c77d88a7801b", "comment": "Malware payload", "value": "fe346e60166e3fc16a87e2f4fb7da532", "object_relation": "md5", "Tag": [ { "name": "46-29-235-240", "colour": "#9F871C", "exportable": true, "hide_tag": false }, { "name": "85-137-252-164", "colour": "#4499F4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870382, "uuid": "8314bf34-de61-41cb-8bc8-44c6ad83f7b8", "comment": "Malware payload", "value": "ebb03085c9091d87e29f79ffc36f35277aaf46ec4356abf29c3bc93e87e8cd82", "object_relation": "sha256", "Tag": [ { "name": "46-29-235-240", "colour": "#9F871C", "exportable": true, "hide_tag": false }, { "name": "85-137-252-164", "colour": "#4499F4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870382, "uuid": "aeb10237-c360-4548-b3f8-f961a1942f4f", "comment": "Malware payload", "value": "5c5569fb42dc0c0abddb72127db8c3e039dece5f", "object_relation": "sha1", "Tag": [ { "name": "46-29-235-240", "colour": "#9F871C", "exportable": true, "hide_tag": false }, { "name": "85-137-252-164", "colour": "#4499F4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870382, "uuid": "d8e4553f-95ab-4cf5-8eaa-685dca6d4e20", "comment": "Malware payload", "value": "d6274a07558cde39f69fbb2f7a2d6a6f6dc406184883497921eecab1f6e81f89c286957affa23fb540aa7bea452e6b3c", "object_relation": "sha3-384", "Tag": [ { "name": "46-29-235-240", "colour": "#9F871C", "exportable": true, "hide_tag": false }, { "name": "85-137-252-164", "colour": "#4499F4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870382, "uuid": "050e87eb-76f5-4777-88cd-d2b40a6a8e2b", "value": "T17F57DF23ADD08274E5DA91FE86FE3B2AC97D9D01033991C759C838985B31AE53A3D707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870382, "uuid": "0ac7c916-fcf7-4d20-b443-d677d5c39e8f", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870382, "uuid": "20427b56-d84b-4a9f-b56f-cf6587f28f09", "value": "393216:lYA0aFsDXcn+B7LsvNaRe/6ekephIJU9RcTLRWbbmT8MQlO9Xks:lwT9WoN1kGFWbyEO9ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870382, "uuid": "43563633-7a55-461c-8f41-294fb711a07a", "value": 27112504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870382, "uuid": "6594c847-af29-4baa-bb37-c97a77462dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870382, "uuid": "f145b905-f641-4c6b-9175-458741f8d83a", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ce1ec0-22d7-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1773844386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844386, "uuid": "baa6d535-aa17-4459-a5bd-7c3334f2736a", "comment": "Malware payload (WallStealer)", "value": "3667fb55168b5bae802e733f5e5ef1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844386, "uuid": "f6aa7ebd-814c-4097-ae40-3027a9619eab", "comment": "Malware payload (WallStealer)", "value": "ebf11a03228f7bb5dae7f7b516aac97eab2e25ff04905c6d660b0d11b6a57934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844386, "uuid": "3d2e3b46-7585-4e91-be51-7a74bc5a3639", "comment": "Malware payload (WallStealer)", "value": "6a4e1c2e0d7f1f2f3cab03c7856ff53e02963296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844386, "uuid": "564d6657-b900-4810-97f5-b4fe0a49a0d4", "comment": "Malware payload (WallStealer)", "value": "14c68f03972e272ea850fadd192ac0c5920f079efac5ed7db37b7f68df7de84e7eb9c4ffdfb0b439352b82e181e5d961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844386, "uuid": "3e938efa-4388-482f-953a-54b45d74d073", "value": "T1FA96638FB2748613C8A263B5B2063572BE2BD435479983777CEDE435319F0BE4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844386, "uuid": "63d8d2ea-9bf1-4b1c-a9d9-ace44ffe21f5", "value": "2c1853915d316a65d08a8dc489aff101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844386, "uuid": "4413c2f3-7250-481e-9b71-bfdedfeef5f7", "value": "49152:ZGI5++d+M3Z2E8BkJ3/xLi3vLbQU/+8UgZ+N+EBqbqARmdhPb3jj++XhVtw+RBLP:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844386, "uuid": "37d4e164-6c50-4b60-ad1d-5cef02a3932e", "value": 9244672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844386, "uuid": "cc2eb01b-582d-49d6-b2ac-70eb88d0919a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844386, "uuid": "69c7ed5c-dcf5-4e81-9783-ef0ddd1181f8", "value": "DAIs3ZV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28117ec-2308-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773865676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865676, "uuid": "438ead47-8364-458b-a97f-382cd79e7d80", "comment": "Malware payload", "value": "5280d654cd519c4ec6dfedb037cd13df", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865676, "uuid": "4bd9538e-27be-4d98-9f5c-099bc9fa2b36", "comment": "Malware payload", "value": "ec033c13f06bcccb3d35b46c56003a60516339419ccc75a3738bbcf7f83e52b8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865676, "uuid": "2ae65a99-d23b-489c-a156-75ff9aa0baa4", "comment": "Malware payload", "value": "5d3b255ed5ad81c4058ebfaad235fcb0ee53e827", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773865676, "uuid": "f8d195d3-e82f-4345-aebf-734066babf40", "comment": "Malware payload", "value": "ec1b99eb003f3d0837ad9ce49d17737e9174a181173a3c1af73008c059c8a4f971188d12d16adeb59ec9d61885294064", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BTMob", "colour": "#3F15CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865676, "uuid": "56367f04-a32b-43ac-87b9-9478ca9bd44d", "value": "T14AF62297FB45582AF0F783B2413A5321D50B4C668743CACB7914713C28B7AE06F9AADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865676, "uuid": "46cb4992-6848-4185-b325-ad5e3d1d70ee", "value": "393216:WY2C4d+qUQ1Fv9wmQOmw3gM6c18J/kf8W:N2dGQLem5+MZGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773865676, "uuid": "04ef4ed3-419a-4568-bd6e-7b0628e2daec", "value": 15300630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773865676, "uuid": "0894e45e-774e-4909-9459-26bbbea9563f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773865676, "uuid": "7be8bf96-f320-4198-be20-47f732a0215e", "value": "update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927282ec-228d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773812686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812686, "uuid": "9e7027a2-42fc-4bd4-b924-013648f4691c", "comment": "Malware payload", "value": "286cfec58469b0e7ce76be4ec6de070d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812686, "uuid": "03725937-a894-472b-be4b-a92f6bd3c6e1", "comment": "Malware payload", "value": "ec6bfacbe15f49d7e015074d29c4ee9f8a918cfe83eb363edda9da7b3236b6d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812686, "uuid": "a3c68bd5-16b0-4538-8c36-cc9f89e3fe47", "comment": "Malware payload", "value": "96cef29d853edbfcb4697282efa0b5e65e34baea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773812686, "uuid": "c7256881-4038-4a50-be91-1218271d1429", "comment": "Malware payload", "value": "df79783c82442acafb8b3beaada58e03e4f155afc0c9026d08255bc97c8070cc25a79ee90e518c4dd68a87ff69b5622a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812686, "uuid": "2a0c4f9b-3364-49e9-9c5b-4b9a1aadf79e", "value": "T141A55B22BE9D8C73C42B2A389C0B97A5693ABE103E3855573BF42D0CDF35781791529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812686, "uuid": "b0ad17c7-1294-43f4-88e6-1c4080d37fbd", "value": "e26a78d2a75ec132135bbbeea7dc9324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812686, "uuid": "12ac43ad-f7a4-436b-bb2c-2a8cc73ff1d8", "value": "24576:ppMvT83VJ3Wb7pWHEvqGKUztkF65RpxxkyC1MeZxQpGJabrm8SBpvjTMD0jb:ppJlJg7p+EvFz5RrxkJ2aQpW9pvjTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773812686, "uuid": "d37674fa-6b3e-484d-9de1-21416c6b14a8", "value": 2097664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773812686, "uuid": "89954252-ec47-4589-9f63-4ea3d023a9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773812686, "uuid": "6cacd83d-64b5-4960-ab20-b9c80f84e5b0", "value": "Accupdatekey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b66961-22aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773825198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825198, "uuid": "13736e57-8c2d-46aa-9d8a-32d2ce880537", "comment": "Malware payload", "value": "9683c8320876b66abfba9a346fa58792", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825198, "uuid": "e8d281fd-38a9-42c8-b474-cdd8b3d0a802", "comment": "Malware payload", "value": "ed2dad816d188c62346f7a36c95c00faedde6b3e0ca93eb4cd156dc4ad62ddc8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825198, "uuid": "2559d9dc-c4b5-4c18-8d3f-c1f90f46aed6", "comment": "Malware payload", "value": "9159f893ed7cb7f4bc6ab8dadbb8b99df72c4e2a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825198, "uuid": "7c69b235-cb59-4fcc-9cdc-ad6598ae623b", "comment": "Malware payload", "value": "51aa9c13f246720697e6da83f6e5ec3b935ab9890debe4fcfafb8bfef379575b5a419c7d336e6e6b2b642ed2b8675522", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825198, "uuid": "48c1d723-3993-4c60-8b05-68ecb8eb11c9", "value": "T15CF41212B4051C37C6AE5E3060C989625C2EFC81FE98AD87D39977EE1F316F2B467168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825198, "uuid": "d3942c08-c103-4fce-a175-f008e78e9f80", "value": "12288:IKzv00rNN0mHohKzv00rNN0mHoVl0Pt8LZ7LT17wdPBKU:RVNN9oQVNN9oP0lClt7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825198, "uuid": "a9c277c3-35ae-4ffc-8851-5ca97986d8fa", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825198, "uuid": "dbb4c897-97fb-4bd2-a60a-2bdca3446ac7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825198, "uuid": "ea5fe384-7da4-4be8-af9f-8de8a497ed2e", "value": "9683c8320876b66abfba9a346fa58792.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cf4713-2273-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773801491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801491, "uuid": "15ece4c0-0f3d-41ed-8607-23001833ebff", "comment": "Malware payload (Mirai)", "value": "1b247c1c5c366c3675f54acbabd17011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801491, "uuid": "a8958cd8-f548-453b-ba81-69b6403b0352", "comment": "Malware payload (Mirai)", "value": "ed9bed52d29c2b6102beae17b16b95d985d94c60c3517dcdc723dad2e52ebc19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801491, "uuid": "b329dfa4-6937-4513-8c4c-099b24b5fc5f", "comment": "Malware payload (Mirai)", "value": "36ddfbdb86c2cf0e9c0a161ea04b74f456d7fa01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773801491, "uuid": "deb6f993-b721-416a-81c8-884bd938229f", "comment": "Malware payload (Mirai)", "value": "528b2fae835101703f187ff55a7c97564668ae73f43a564da23b9ef401952816b893b95167d926c762486fe24b4c2f5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801491, "uuid": "e63c63ab-cb40-46b0-9f51-c35999db7ce4", "value": "T1C81301AF26D13804DB30D974CBB0E1CA8FC8F46AEE22763A5F017DE92166B6C535C546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801491, "uuid": "7e63e285-90bb-4caf-bdad-5c362bb3088e", "value": "768:cLWnHc+lFtsYJWAv4gdwfChDx211o+Ep7W4TYs5R7gPcEdubKi5q3Vm58F562KIP:cLWnHZtyKlVG11IpjY7cEhFq6bBcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773801491, "uuid": "d387bcf2-6eb7-4b41-a3c4-06362cf3ebce", "value": 43140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773801491, "uuid": "95ee828e-02e9-4ad7-8d7b-5932de7a0655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773801491, "uuid": "c76a0714-7005-4807-8892-f1bbe1e426f5", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d35d9da-230f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773868485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868485, "uuid": "02ad0615-57b9-4e2b-b022-385771277259", "comment": "Malware payload", "value": "30537cb3508d82eb5936d2d9bd0ccbcd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868485, "uuid": "3589fb56-1642-4e70-b673-4747d52a8591", "comment": "Malware payload", "value": "eda6f2c372106d6b754ee7a40ef51952c16a324133d54bb235a11195fc82b69d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868485, "uuid": "990de5ed-db3c-48a7-b5e9-4c28956d4a36", "comment": "Malware payload", "value": "4d87e4808211ff9c32c8d967ea268bdf79ff2283", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868485, "uuid": "3f6477b4-cc5d-45f0-bc61-af901d630be6", "comment": "Malware payload", "value": "77ffc0907012b590ed50158c7b6f5c3ab89c3af6b07b0c61cdbd6ab778f953b3fa17fe952d3afcf3b5ff446cfe99fb9b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868485, "uuid": "191d38e3-316b-4d08-8e68-06e679e62cf9", "value": "T10B57334AD8A54E47E83BE43288E46C6E0971FC458F82581BA55A739B99FF7F4163C00E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868485, "uuid": "1d9419f2-c08e-49b3-a98d-566fd91e4857", "value": "786432:iVPFbnttPdnZKPg4k4/Nf0fS8PfCo4IMPm2m3TNc7wV:4NLDPdag0NfYzHuPUmsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773868485, "uuid": "6441c74f-23ef-45fd-82a0-611c84d8756a", "value": 29339648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773868485, "uuid": "468ee0cd-1f7e-47a3-a0c5-9dc026b7172d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868485, "uuid": "f6741b41-624a-469b-85f2-7fc53be8df49", "value": "Deepp Sleep.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c85d40-2295-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773815970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815970, "uuid": "828ffa65-6952-42b7-ba80-8ffb42307376", "comment": "Malware payload (ConnectWise)", "value": "09df035a337da465fa99604b2b150574", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pinpadat-com", "colour": "#44C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815970, "uuid": "78738201-f8f8-42d0-80bc-d2ce1984aa32", "comment": "Malware payload (ConnectWise)", "value": "ee2053834c4807a276423d94b44b4e3319736bffd41630de96efe6ea5856269e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pinpadat-com", "colour": "#44C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815970, "uuid": "75b11263-8278-4d31-9d44-328125f3964f", "comment": "Malware payload (ConnectWise)", "value": "d69d2d3409a6a4846c683c7dac200254c2963d3f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pinpadat-com", "colour": "#44C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815970, "uuid": "84f45c1f-5f2c-48a1-a483-e35603b2e598", "comment": "Malware payload (ConnectWise)", "value": "17c8480c285fe8f6887fa14e27e7486ea40c76ad4552e6e48b8e69fc1628c3a14a0d3a7b7f03ea40f6170aab55a4fd8f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "pinpadat-com", "colour": "#44C509", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815970, "uuid": "e70ceb3e-9b77-4c7a-98bf-cc9b6c6a07ee", "value": "T1D8A623116BF8D278F1F22A39D876A0B1A5367D119E23D12E2324791E2C75EC08A73777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815970, "uuid": "14c62e5c-55d6-4141-8152-5d1a11458d58", "value": "196608:oHxcp9ym3nltDUJVRHxcp9ym3NHxcp9ym3uHxcp9ym3VHxcp9ym3:2GplpGGp/Gp8GpHGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773815970, "uuid": "580ae928-5dfa-4778-8c59-4f0810edd694", "value": 9965568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773815970, "uuid": "7c1c54a4-73db-461f-94d9-a064293d373c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815970, "uuid": "3e488dd9-3a45-414f-95db-42acd555ead6", "value": "ee2053834c4807a276423d94b44b4e3319736bffd41630de96efe6ea5856269e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178886e2-22d3-11f1-a769-42010a9c0008", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1773842545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842545, "uuid": "91721088-68e7-4f84-8955-4fd94818ae16", "comment": "Malware payload (QuirkyLoader)", "value": "50c66833facf937641edf9c471854ad8", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842545, "uuid": "07d4d463-7399-4c6b-a925-afd80ca76172", "comment": "Malware payload (QuirkyLoader)", "value": "ef4bda77b3391e7d6a36a1d927fc81b1499c36f3d65322ed5f274a3742e07ebe", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842545, "uuid": "59eb8966-0be3-4986-95a7-88752a4af575", "comment": "Malware payload (QuirkyLoader)", "value": "295e39eae4899b72ddba38bfe52dbc6640c6433e", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842545, "uuid": "f8f23f97-b899-4af2-b2bb-fe0c3df15961", "comment": "Malware payload (QuirkyLoader)", "value": "9fdfe49d88fa45472404f2ce4706c713adfc780008782d868fd10e7a3b85cd9bc5874e33b1826fc2980f3df7a4fe4bb7", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842545, "uuid": "408f6a3d-0dda-47bb-beb3-65e579251f6e", "value": "T19C16BE55E3C829E9D417CA388744E333C2B2B9634B76D08B5A9AD7061F779624F3FA40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842545, "uuid": "1a06b7c9-f44a-45a2-a082-43a8dce5b8a0", "value": "2ecf0f36b78ff6ae7f4aa3f199a901cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842545, "uuid": "3e0435b2-d711-45bf-af16-d9506370411d", "value": "98304:hfGlkMNOHOQ7bKgNAxIr9RDLwZt5cG/2I2Ua7bDf2s27fEvgylxBc/ssTUrp:hfGl1NgnbK2rTDcZC//27SXxussTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773842545, "uuid": "0de8e289-1db9-4ade-a2bc-c4809759747f", "value": 4048896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773842545, "uuid": "45fa0d75-1e65-48cc-b01f-76b8a724c771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842545, "uuid": "b14a04a9-b1b1-4c52-93f2-548eb476fbe5", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1754bd9-2313-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773870345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870345, "uuid": "9b2622f0-7ad2-46c6-a905-4f83386c78c4", "comment": "Malware payload", "value": "fbba585bde3395f2348b94291333a1e6", "object_relation": "md5", "Tag": [ { "name": "46-29-235-240", "colour": "#9F871C", "exportable": true, "hide_tag": false }, { "name": "85-137-252-164", "colour": "#4499F4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870345, "uuid": "618f3b37-d823-4da2-bf1f-1a9ff5178aba", "comment": "Malware payload", "value": "f20be8f671bf98da730fcb586dd8c1f23118ea723d2897502fae3329a89fe778", "object_relation": "sha256", "Tag": [ { "name": "46-29-235-240", "colour": "#9F871C", "exportable": true, "hide_tag": false }, { "name": "85-137-252-164", "colour": "#4499F4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870345, "uuid": "b91bf06d-511b-4f81-a740-6f15d5ba7f60", "comment": "Malware payload", "value": "27f715b6f45513cc04adf76e084bd1bdee4555d3", "object_relation": "sha1", "Tag": [ { "name": "46-29-235-240", "colour": "#9F871C", "exportable": true, "hide_tag": false }, { "name": "85-137-252-164", "colour": "#4499F4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870345, "uuid": "3ff9f365-85b0-4083-891f-c8494d3f75d1", "comment": "Malware payload", "value": "32a3d3cdd6f830c7ed52d48177b4b3a2668c0132ec6876f152f4a7370429fc7a88dae67270de4f68577f0a4fe8121688", "object_relation": "sha3-384", "Tag": [ { "name": "46-29-235-240", "colour": "#9F871C", "exportable": true, "hide_tag": false }, { "name": "85-137-252-164", "colour": "#4499F4", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870345, "uuid": "2f4f35aa-e8ce-46b5-a630-1037a205d9e1", "value": "T1EF57337CCC0FB564E165BE3EE043971AD9E0AA0352642E4EA6B424A85DEF7C9C781317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870345, "uuid": "2f2deed3-e11c-41c2-8b93-691e1083c631", "value": "786432:RKK/8/2vD/QMsz3wUHQNWCd4JEr6Htt2GgGQ:RKFeL/Qzz3w0QOZNzHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870345, "uuid": "3236fe5a-24c4-419f-b117-df16d5787e6c", "value": 27539786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870345, "uuid": "10de12c3-1fa8-4af6-815e-9e1848f2a0a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870345, "uuid": "1447d794-38b6-4024-bb40-85c09fa75541", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c5009c-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773827191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827191, "uuid": "0049dd54-8fa8-458f-861e-4b7af050cf1d", "comment": "Malware payload (AgentTesla)", "value": "29d4535c12457825e8e1613b6965637a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827191, "uuid": "cbdbd05c-f8f2-48df-81cd-d1d0598743de", "comment": "Malware payload (AgentTesla)", "value": "f275be8ed40ec5bdfe9d4a46f784ea513f30aa8d699a48a3dd71eca95d40376d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827191, "uuid": "d7d7b7d0-22bd-41a0-aba4-91fb63fb56ae", "comment": "Malware payload (AgentTesla)", "value": "bb3b98061f79f77376fa9ba75c13210bd58df2ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827191, "uuid": "3cb6cf18-7e19-43ee-8550-01ff15f97a55", "comment": "Malware payload (AgentTesla)", "value": "5e55c40113848ccdae080948ce49983e073a6f3297820c6c9039496b658919b091b7c0d260ae270bbf26a6d1ce119f84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827191, "uuid": "82ba6d35-7fa3-4200-91d1-de10dd942310", "value": "T1DF4568F75887AEDB49868DC4162A21ECAB0D6DDB2302DD6E34B0CFDF829112ED24575C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827191, "uuid": "8a6597bc-bbca-4d93-a431-c891f4e57da7", "value": "1536:Zccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccx:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827191, "uuid": "0828fc0e-ea12-4175-8548-777fc916ab3c", "value": 1190542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827191, "uuid": "4f3721c9-145f-4312-8db9-0350a960df10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827191, "uuid": "52d859cc-9727-4e86-952e-7a3e5d5b36d5", "value": "29d4535c12457825e8e1613b6965637a.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1764545a-22d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773842974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842974, "uuid": "bbce0043-9b52-46aa-93f7-49c9b9fbb8fe", "comment": "Malware payload", "value": "2da69b5800b8d7ff3bd0b1bd917c098c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842974, "uuid": "e3dd3996-6759-4a90-8750-e5d66f9e23ba", "comment": "Malware payload", "value": "f2b8b654712bbcf88e8c6cc845969b3d78720d1bdb3226bc2b4978f6ca1907bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842974, "uuid": "6d326e1a-4a49-442d-9b05-89d15690fd34", "comment": "Malware payload", "value": "0b5163898f47128b367ac76917ad9e213df11f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842974, "uuid": "52f3e9c2-3e35-4445-8032-75d0f4b3a789", "comment": "Malware payload", "value": "d14a66da2906505ee5a1b322b9aec90407e5f3261a8e906c0b883f0c6a053916bad92dc43262f4280d41cde57ba459bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842974, "uuid": "59e1c97d-06f8-45bd-a29c-bf3f8361fca6", "value": "T1E5D3081EBA5AAE11C0A81B35C4D7B51407B1A7C77277CF4E3C8913550B223EA5D8EACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842974, "uuid": "587b9411-395f-417a-b167-66daf4ef613b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842974, "uuid": "3c4a7e9c-2316-4501-ac8e-f908f9b357dc", "value": "3072:UKWWvGeHY4i3GzT9UZzZTQ2APEv19REJqhZ6tUP0g:UJNejc62KC1sVFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773842974, "uuid": "f97bc8d1-0b6a-42d1-aca3-679c21ebd395", "value": 140960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773842974, "uuid": "6a35ef4f-d7c8-42ad-9915-74f22b3a18a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842974, "uuid": "699a0906-a01f-4bdb-a3e5-04b7d98ad96c", "value": "f2b8b654712bbcf88e8c6cc845969b3d78720d1bdb3226bc2b4978f6ca1907bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8352b67b-22d1-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773841867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841867, "uuid": "65982e1a-4f05-454f-baf0-4f40177cbb2f", "comment": "Malware payload (ACRStealer)", "value": "e436d75db2a6f096f2811f8b57d0a321", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841867, "uuid": "e3b8bffb-bc28-4c78-b757-3edd7dc88192", "comment": "Malware payload (ACRStealer)", "value": "f307c8d66e82b8130c89547966782395e30824341eeee008abac223fe91f46c1", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841867, "uuid": "634e34a6-3954-4404-b186-84357e6b6f01", "comment": "Malware payload (ACRStealer)", "value": "83cc7117284ccec21c71ebcd40a5561e68b68c46", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773841867, "uuid": "a85078e4-c754-4dc8-918a-c44b142f2a9d", "comment": "Malware payload (ACRStealer)", "value": "deb5c533bb4b77206f5145389ed4b06472b4a726a460235ca24b6ab08d892deee4f2e565b7c0579d3e533a71bd792176", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841867, "uuid": "5ac65524-a827-4df8-8260-12104be05b19", "value": "T18D551B46C5C51963D6630073691ABA43FF3D088A415B9C1F31EE96EF37A3AE9937B060", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841867, "uuid": "d0cf44c1-9b4f-41b3-adec-87e0797f336a", "value": "8b4df0a9732d9c781af1f10bfd223b5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841867, "uuid": "f4fd4535-8c0c-4e27-887f-a1cba496e9e7", "value": "12288:hQE1YBZVMIq53+qo/XKG94nlevNtmvWMUBQvKYC30jlwHPygI5RD5JZDjV:hVYRMx5i2leVtm/UBa5vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773841867, "uuid": "57fde7fe-1e62-4d19-a675-34329dd48f00", "value": 1373184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773841867, "uuid": "0ec28e75-0bfe-42e5-9229-4566ef5d67ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773841867, "uuid": "2d5b8ef9-2c04-4300-be5f-df5675ce9670", "value": "SecuriteInfo.com.Variant.Fragtor.933941.15821.10793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf1a0d4-2272-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773800946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800946, "uuid": "baef9b3a-c471-489f-a904-52074f07c105", "comment": "Malware payload (Mirai)", "value": "e71f391496f40498c913fddf74a342cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800946, "uuid": "a7a118d6-2809-46e7-82b1-e3ab00630394", "comment": "Malware payload (Mirai)", "value": "f30856c95d68ab3b4361101905746525a36dfb62dd3b564de0a1d92581d756d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800946, "uuid": "142db49c-6cab-4a54-8a6a-f3e517376d95", "comment": "Malware payload (Mirai)", "value": "909e3db1fdd38b78838ceca7a4b02e6751d6aa33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773800946, "uuid": "12cc2570-521f-465d-9680-c22b94fe9f54", "comment": "Malware payload (Mirai)", "value": "ba245b6846a35db5aec2d1e505780c95909108e8f8f90f1015b84596eb143ddfcb2087cb0cb833644e816ffadb28c16c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800946, "uuid": "41bbcb70-c713-4ad8-93ed-0c2b028d98f2", "value": "T1DFC2D05C022558EFC61FC67A14EA1B521E6223766E27C91FA84FED5F2C4A84D7843FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800946, "uuid": "c81cbb3a-34f0-4c8f-a311-0c0ce1583855", "value": "768:xDmZ5K1SOIPZWPowYpw/SFTqrmv9cXfLAY9AJgGlzDpbuR1JZ:1oGUxW5BAAmvOvuVJuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773800946, "uuid": "7275fa38-dc6f-4cd7-9caa-9890fe082c08", "value": 28292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773800946, "uuid": "2881f105-8051-4ed4-a59b-aa6af6cf8ff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773800946, "uuid": "1873c78f-8090-40d7-b11f-8ecff7e5d76d", "value": "dontcrynow.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5fb998-22af-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773827254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827254, "uuid": "9bdd7a1d-aef7-4ac4-ae48-2548bbd03214", "comment": "Malware payload (PhantomStealer)", "value": "68f72c95c617047e717ee73e7b9eb3ef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827254, "uuid": "d9d9eaa4-63b2-4277-abcb-00ad04c6c8b6", "comment": "Malware payload (PhantomStealer)", "value": "f3275575509cb46dca7dd549bebd58de278766e16c5ef0d1d8d6ba15222fcd45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827254, "uuid": "972f958c-fb57-4b2c-8fc7-869ea9f6665a", "comment": "Malware payload (PhantomStealer)", "value": "ab80e296e6e811d55cbf086c16302d1703c5aa9c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827254, "uuid": "e9ce217d-c794-4d0b-b2f3-6083dad928af", "comment": "Malware payload (PhantomStealer)", "value": "733810710914e166c397fafa313f8ccfb42f245e408eef1e0709d1e73f4a39aadb2baef6265d805b7b092f7e54c0701f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827254, "uuid": "127595e0-82d7-4188-901d-3661c54fcbc4", "value": "T16D26AFB16DD18941CA18731CA1FF825623B201D9E0622BD51AE6B8167DF788F57CE3CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827254, "uuid": "3cd45685-fccf-4903-a3b6-8684d549a890", "value": "24576:pg2qVgELkVVIf111dowEg/BY/Uc0Zjy1Ybogyv2bbVLS9KwWr1oVsXdKQIDDM3Ul:p0nhqk39TofaqUPeR1FIZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827254, "uuid": "80cb55cb-5ff1-408c-b501-a5b944391d6f", "value": 4574707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827254, "uuid": "322a1850-1817-400c-b751-ecbf6c3c4c1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827254, "uuid": "0e6da340-41ce-42f0-9992-08e1ae88e509", "value": "68f72c95c617047e717ee73e7b9eb3ef.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d286fd9d-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773826538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826538, "uuid": "377bc93e-9bf9-4020-a48d-a55be96926f0", "comment": "Malware payload (AgentTesla)", "value": "dbb10f6865efaecbd9f38f51611908ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826538, "uuid": "8cb5444c-30c1-461b-9d7b-5d5d81e51f2a", "comment": "Malware payload (AgentTesla)", "value": "f457686a24842160b15aa2e49208cdf9af6a94bfc4d37c764712fb8f48a0d0c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826538, "uuid": "b5fab00e-f7f3-4fc8-aabd-7665b3238bd8", "comment": "Malware payload (AgentTesla)", "value": "860378e93d5d795b2f734bc9874cff80b0f41922", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826538, "uuid": "d97a4c87-46b1-4902-9fda-c4e28f441bf4", "comment": "Malware payload (AgentTesla)", "value": "bfc686365adb2a573daa838ff774b8ea33bd1f9dc91936c1abf3188613ebb894377354f8846f48c211f8b43c63e8f9d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826538, "uuid": "37d912ac-b43e-4230-b1f6-aaed234d75ae", "value": "T1B825F1593795EA03C5A25FF44970E37427B49D986521C313CEFAACEBBA3970A68013D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826538, "uuid": "4f227989-4de2-4706-8e56-672abaec9ebf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826538, "uuid": "51051c5c-f0cc-4e05-a093-802eb9968e27", "value": "24576:1ciabCZaBE1Z/BuTgIdWoJ6Qc+z6BlKvWs+yyH+4qNq:1cykEvBuMIdWoJzzbuTyyH+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826538, "uuid": "e19c9e57-8be5-444d-a5b8-6cdf2e77aff7", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826538, "uuid": "b9b50796-9e3a-4a9b-a1bb-5ac18c226af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826538, "uuid": "2249e5d5-76ab-46b5-af61-a79b5e975eb4", "value": "DHL_Overdue Invoices - FEB.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1936a0e-22b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773828227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828227, "uuid": "a6ec4355-0d53-4b40-a0dc-8dbe748bce3a", "comment": "Malware payload", "value": "b7ee1de8b5bfcd3d708b1c1e708d8962", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828227, "uuid": "a4a414ae-dc4c-4b33-b733-c45a182860e9", "comment": "Malware payload", "value": "f5bdb44b65d061fbe0ba38ab0bffd13fbfa28501216f20402fb7e1147f6f7ac4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828227, "uuid": "549bfc87-d78b-4f70-b192-89e83e27b51c", "comment": "Malware payload", "value": "9d2d13314056dfdd0466f8239f5c4f7db661aece", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773828227, "uuid": "fc4ee67a-7cdf-4167-8a9a-f82a5645da85", "comment": "Malware payload", "value": "f6f8df4e357e484d1e8e01684b3946a984f1858ce32f801e35650e391a2230371991f9815a42fec6f7fa0b79af00f7a3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828227, "uuid": "d8c3d717-0222-4bfc-b578-adab0557aa98", "value": "T1D0C19BF196AFECC5B72C4481D794AE8E5D33370BAA241DF0F4255A48A2C972375FE086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828227, "uuid": "59e9abcc-f1fb-420e-86a6-42334ffbad71", "value": "96:loBaaqGFCArTJMqVQkOV0leWLBXIgehfKG2ZL7U4bl:fPMCArTJMQOV0HBXInK9UCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773828227, "uuid": "b6cd939d-0f2c-459c-a3d7-06b0aca013ce", "value": 5740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773828227, "uuid": "e53eb7bf-544d-4244-a60d-1e41293dd8bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773828227, "uuid": "cd7f14d6-4906-40b0-873e-499071961bee", "value": "b7ee1de8b5bfcd3d708b1c1e708d8962.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e05b94-22ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773826456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826456, "uuid": "fda048fd-a17f-41c1-ac21-5a27de9b0399", "comment": "Malware payload", "value": "77b546a58ecd288b0a1feded7e0b86e3", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826456, "uuid": "c86162f1-313d-4d99-b7c6-7ea2c3c383b7", "comment": "Malware payload", "value": "f664ef2878d46bbe40913ea77ac767aee515ab5dd2aec27d20673cbe2e7a2209", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826456, "uuid": "04bbc744-54be-4ccf-b743-035f147dbc26", "comment": "Malware payload", "value": "354760a64b468790211ad81884419748b4eb1eb9", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773826456, "uuid": "d7a9eb6d-bdfc-413b-b5a0-c0c8f587cf43", "comment": "Malware payload", "value": "5340beebe0969202c0c94d4ec6029a0b43aa1d098dad84777257fa0f15f6d2c23b3013a69163da5cfad7522f7ee51e5c", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826456, "uuid": "eb1b99b1-d303-4e69-ab23-5b29d00f0fbc", "value": "T14403A6C97AE272A0236230F36D2B7099F36D6C8CB70C8195F795A498F828739D17597C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826456, "uuid": "c2a02e3a-a64b-4e2e-ac9a-69ccf6b85975", "value": "768:D+NVgZTlsMEDynXuasEs7XKbKm2l1M+zm0Ii:yITlpEDyXuasEs7XqKm2l1Fa0Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773826456, "uuid": "42d0de8e-937a-4e03-aa3a-794e185178aa", "value": 37744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773826456, "uuid": "8177e588-9e41-4c4f-ac29-45b869bf0965", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773826456, "uuid": "ad150f03-f03b-40cc-972a-cce977831223", "value": "77b546a58ecd288b0a1feded7e0b86e3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef6ddb8-22d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773844383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844383, "uuid": "10b99234-80f2-485c-9fde-eb67e29342a0", "comment": "Malware payload", "value": "7e110bc156933ea0929f83f64b5fca7e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844383, "uuid": "ef0890a7-fd30-4a3e-962a-8f500bb0ccf2", "comment": "Malware payload", "value": "f72e4829ecebb5ce233703c08d40783e9bb8f3a04b06777618a4a4efe6f0c8f5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844383, "uuid": "a8168647-18c9-49aa-a6ab-910cbe05682b", "comment": "Malware payload", "value": "a4868f13212c45770c8becdc8f4df10c94290824", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773844383, "uuid": "6e1ee9df-e178-47fa-96b1-5073686f221c", "comment": "Malware payload", "value": "4b16e0b4cf79f56b7e306d249c67e4a0267df67fecc961b05ad7df6ca4de06fca54319a0ad506db3cf8b9410cf5e3fb7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844383, "uuid": "35cd70a2-5dba-4efb-84e7-f88fe6ba40d6", "value": "T15BE0F110B316300F4AA7C0D25C08D0D5AA5CD2CC03367EBFD6D59D0498801E95DAE21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844383, "uuid": "e682cb9b-b88f-4846-b6ee-aec16e7e3c45", "value": "12:wbYVJ+JFmBap984CXLgyaIS1PKC2ALFyGHDfhgW1MnGgpk1Q:wq+j+apEXLw1PKC2kFHDi6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773844383, "uuid": "3811f079-dd08-4775-8085-87de147b2102", "value": 408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773844383, "uuid": "1a03e3ee-b8cd-40a3-953f-fa4e87efc815", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773844383, "uuid": "9c6851c0-602b-46b2-84d3-39270f6989b7", "value": "1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5caab5-2276-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773802875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802875, "uuid": "584d41b0-0a82-4f97-8a16-b61dca451ad3", "comment": "Malware payload (CountLoader)", "value": "0dbec4c9de26da707a8a84952327259d", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802875, "uuid": "e82023bd-8c54-453d-8e9e-1356f373e746", "comment": "Malware payload (CountLoader)", "value": "f790794133d4017f9e81125038c6f63845603ba353f36e786f3359f4acf3449b", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802875, "uuid": "eb5a50e8-9d64-4711-bc62-c6bd118b52eb", "comment": "Malware payload (CountLoader)", "value": "2b255c4492fab29843007e864a02ce64ed92915f", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773802875, "uuid": "4fcab400-a0c7-45d5-b288-3cc9848de479", "comment": "Malware payload (CountLoader)", "value": "05463bf3b30bc10a8fd9a3254d8242776abdf20993a30420bef02668ac4d4df2bfa35d321a48b00c2f761a9ae64909ef", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802875, "uuid": "a9d1393f-c833-4556-8341-fe0ab146b231", "value": "T123B33FCE4ACEC8A5875F7016451E9D4A8B8E5123461EE5C0BEDFFE683F268A073E55C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802875, "uuid": "de61994e-bbd8-4bf2-ba2a-ca4084c0830d", "value": "768:YWfgniJC55x50xMLQbH+4jOYTHxfYSI0r/1q5quX3vVKxSq2uv/27ikyc3KFj0xN:TiBFezi3vVKBUaF4xsqeXX9UZXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773802875, "uuid": "b0949d31-d78a-437f-aff8-20d3fa023be2", "value": 115329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773802875, "uuid": "200b0bb2-4717-4b25-ab3a-02cbf20e4342", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773802875, "uuid": "d6312c49-3cff-4d51-b534-7ee27f1b6eb2", "value": "Edge_Build_France_4676.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb56dd8-22e8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773851578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851578, "uuid": "ad69f632-f204-4ffa-9104-5c94e6d200a4", "comment": "Malware payload", "value": "f42211277d3c3793ca733e74d09bd8c4", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851578, "uuid": "264b108e-15f5-4cf3-931c-99a543ce1b93", "comment": "Malware payload", "value": "f8af37fba1ea756c4d9197e1b9ff48faf079a1f6baf4e27805211088162e7d6f", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851578, "uuid": "9aeda89c-9eec-4ba6-8973-536aded4f804", "comment": "Malware payload", "value": "99913f14436f5d940a74a1259aac0c79087991d0", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773851578, "uuid": "32daa565-bfd7-4e38-948f-af075526e575", "comment": "Malware payload", "value": "7cab83371fc22f6748e303a343f64e78cf1a87e4f1a9088fc1b95ad27b8096afd8c272474401f768dea54b2825f5500e", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851578, "uuid": "16d7cad8-3a00-409f-802e-8a453edc105a", "value": "T13F2523119EAF66F9059C8E2931FF2D193EE0CAC035FC8492FB44565B1B36F534366A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851578, "uuid": "78958ca4-eb17-44ed-a7d3-809389da9dc7", "value": "12288:pYKO/I7dgUszX0XmLXMmB6dExIJcLVq8XX/i8/+bwYrl+j4N22uRXR6lpLFAebl2:qKOiIKm4qKK8WrWb80uMxFtZK+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773851578, "uuid": "bbc2c59c-66ce-4c7f-bac2-d96f6088d447", "value": 1038540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773851578, "uuid": "2e8781c5-e21e-4539-8fb4-d74874ce3543", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773851578, "uuid": "2b90f81d-c9fa-4369-8630-fb6a91b7dad5", "value": "1PhMAR17_Hvvvvvvvv.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439dda99-22e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773849061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849061, "uuid": "76902c29-7588-4784-851e-85b38f52c996", "comment": "Malware payload", "value": "a3fe5993b0dd6cc9f55ccc5f8f09a71a", "object_relation": "md5", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849061, "uuid": "03f8208a-0be4-4b7f-bab4-a0bd6b5ef7de", "comment": "Malware payload", "value": "f97547c2843975161b5d0c56670980e3533778262ab84a3544ab7c56c6c11aab", "object_relation": "sha256", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849061, "uuid": "c848bbb4-9916-4de1-8dfb-d7fc31351d7a", "comment": "Malware payload", "value": "7b31cb0123fab57310d85adb791fdd537cf45c46", "object_relation": "sha1", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849061, "uuid": "b4e3e414-e23b-4b70-aff5-7ced2767b107", "comment": "Malware payload", "value": "0f139c4e5af56b7111d78ebc5116570dbe9e2aabbdd01d7d9ef9b975f1e7058c16024e49180c9365df8b86dd444e3dfc", "object_relation": "sha3-384", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849061, "uuid": "c8165061-d783-4b92-9817-a6896e48bdb9", "value": "T12C3623500AC96A3E095CB239240B2F6FDFD1FD3C608CB6D46F80F8469ACAB49477AD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849061, "uuid": "563aa02e-9f64-4dde-83aa-a530ac384551", "value": "49152:O0ds5eylWQeT7GgYPAgynLwkZFhPl/1687q77OlBeSCmM/MowjjojSbk/oDqE5IB:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773849061, "uuid": "70bbb98c-e002-443f-8e06-9ebd9d5cd727", "value": 4883296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773849061, "uuid": "1ad9c648-57bf-4498-ae5c-e083b90551be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849061, "uuid": "cb291f08-6612-4d6d-8509-3e71c5070d4e", "value": "f97547c2843975161b5d0c56670980e3533778262ab84a3544ab7c56c6c11aab.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85600e1-2293-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773815354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815354, "uuid": "f43ac389-f33b-486e-8c0c-3b2b97746d8a", "comment": "Malware payload (AsyncRAT)", "value": "05aff2b6242e9b2618ade8d34178d46a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vps30002026-kozow-com", "colour": "#631E01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815354, "uuid": "720f758e-a04d-40b1-a4ba-45f3b1f61c1d", "comment": "Malware payload (AsyncRAT)", "value": "fa23a1aa287992ff7636622d1158ad740d0fda313d5e9e07de5f0e3fecfa889a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vps30002026-kozow-com", "colour": "#631E01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815354, "uuid": "3508f96f-1a9f-499e-a03f-0430ad705422", "comment": "Malware payload (AsyncRAT)", "value": "9c1b71b7c965afe4075e81af8ff050c7649e703b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vps30002026-kozow-com", "colour": "#631E01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773815354, "uuid": "4b44f699-c43d-44a0-adf1-a23eb54d77d8", "comment": "Malware payload (AsyncRAT)", "value": "9d162aeabf0797b15453f2720fb8803fbfa29d53780e20c47e6cd7a92af8ab0f338694c1b34f388db609c66daad52885", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vps30002026-kozow-com", "colour": "#631E01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815354, "uuid": "30ed6be9-6f86-46c5-9914-d850d2479361", "value": "T154235C003798813AE6FD4BB4ACF3A2458275D65B6903DA5D7CC814AA1B13FC5D6036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815354, "uuid": "5379511e-2b45-43d7-bbdf-4e4016348e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815354, "uuid": "cbed9101-3a6b-47b2-9bc1-bf86f1acd878", "value": "768:sq+s3pUtDILNCCa+DiA9anAL4KiiiLYb8geDGqg6tvEgK/JbZVc6KN:sq+AGtQOA9U64KMkbTuGqg6tnkJbZVcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773815354, "uuid": "d2ab2ec9-033e-40e3-a814-87b0087d76e6", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773815354, "uuid": "078d67d4-d5b2-4949-b10f-712b1ebf6547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773815354, "uuid": "eb5618d0-84a6-4de4-a593-648ee9347b62", "value": "fa23a1aa287992ff7636622d1158ad740d0fda313d5e9e07de5f0e3fecfa889a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb9dfcc-22ae-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773827013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827013, "uuid": "03d2f872-e97d-406a-a678-026f4bb68b88", "comment": "Malware payload (AsyncRAT)", "value": "247a9cb4b204a1305e074e1f2f17844d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827013, "uuid": "93579367-01ba-4922-b798-c97dc1c2fbc0", "comment": "Malware payload (AsyncRAT)", "value": "fa80a60b77e39cf7f951157a30141eca81133e0de75540246916069f3c8e7bb7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827013, "uuid": "7bfa7919-5ed7-4abb-ad66-8722aa6780d4", "comment": "Malware payload (AsyncRAT)", "value": "d29b9bf99f81ef54c201fa637ed2ed0156710142", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773827013, "uuid": "bc9a6c8d-c5d3-4bc6-9094-f4eb07fc1e7e", "comment": "Malware payload (AsyncRAT)", "value": "708b278b62fb58a11a4b75e865c32898c0edc8b992a4c727852f2879abcfe0bdb7ff202c9f15ba84a71012dd91839cb9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827013, "uuid": "58991b9b-b372-44f7-9c92-c0f4263e7324", "value": "T18184BF7D9ADF7D98A21C3B37303E594FB2D05D8563493580EFEB7D883A25B10A6290E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827013, "uuid": "1a9c178b-21c8-4606-825f-a02d05fad8a7", "value": "12288:P5TL2Tosz8l0EGvsYYHIhE/8vZpVgR3d8CM8:eFYz/zmf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773827013, "uuid": "8f348695-11e5-4121-8034-ee799458ec4a", "value": 401661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773827013, "uuid": "13ac382c-87f9-49d2-b193-5af414432488", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773827013, "uuid": "8b854186-21f9-4d86-9ad0-1451a4d72477", "value": "247a9cb4b204a1305e074e1f2f17844d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f6ce5-2315-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773870933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870933, "uuid": "cc683f9d-c818-40b7-a97c-7013f30514eb", "comment": "Malware payload (Vidar)", "value": "2ad20790a20b4797e8d0e511cdc889d1", "object_relation": "md5", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870933, "uuid": "cb1327b9-8cd3-4488-b623-b76303038747", "comment": "Malware payload (Vidar)", "value": "fb329c4f4383bacf3ee019290ca6be725aff66c4f56af16469c9d44f2716b341", "object_relation": "sha256", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870933, "uuid": "c736c4c2-6f40-44fe-b044-e3869cb226e5", "comment": "Malware payload (Vidar)", "value": "7c54306c923f7aef75bf38d9ba0b152ee455d788", "object_relation": "sha1", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773870933, "uuid": "7aed58a4-c646-4731-96b7-4eb9d0ccc4ef", "comment": "Malware payload (Vidar)", "value": "d9d57b28fdac378a25150b83aca39f133d0262d44650e3818adeffa79ceeb799aa6c4559caec0a7e71fdd2c4fd348c36", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-239-146", "colour": "#50A447", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870933, "uuid": "20455c7e-c5de-4821-b88f-2fa6dbcf5637", "value": "T19C856C0BBDD418EAC06A973689B762927B71FC590B3223D71EA0B6782F727E05D74704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870933, "uuid": "8517a965-4391-4f73-b40b-513d98533ece", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870933, "uuid": "04dce103-9c7b-4851-bca9-7c7a26759685", "value": "49152:xDLjpJryD2e9r+L3zYw6EftRm2ieBEI1ku5T3b0saaPf1E5TUf:xDhhTvzYw6EftRm2ieBEI1ku5T3b0dor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773870933, "uuid": "0bf78ecb-6194-43fe-b0d2-6c5d3ca87d16", "value": 1865728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773870933, "uuid": "0d0f4eb3-699a-4389-a714-f4eb9809b05d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773870933, "uuid": "e8e4ea8d-da52-4953-892e-d0cfff399435", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7ffe07-22d2-11f1-a769-42010a9c0008", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1773842498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842498, "uuid": "fdfb5aab-3874-4327-8062-f35086de62ab", "comment": "Malware payload (QuirkyLoader)", "value": "1f75d4cf40aea5ed2ff7a1946f67a129", "object_relation": "md5", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842498, "uuid": "39d31023-4f20-4b63-91cc-de8aa8a927ca", "comment": "Malware payload (QuirkyLoader)", "value": "fd3eaadc11db033a3dc38941890021e99456fc14f694917fb8f09dda279790df", "object_relation": "sha256", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842498, "uuid": "79846f36-3339-40df-9e39-4429780b23eb", "comment": "Malware payload (QuirkyLoader)", "value": "562c427465bb16abba1a4ef5e1de45efcbe868be", "object_relation": "sha1", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773842498, "uuid": "c2b0262f-ca56-4d1f-b936-657722c64bca", "comment": "Malware payload (QuirkyLoader)", "value": "645093fafc1dd8b94dd28009ce59cb8a901a4f2afc52abadaa0398227208390ebb73642336e7ac28ad894cd9a8aca4a9", "object_relation": "sha3-384", "Tag": [ { "name": "asmweosiqsaaw-com", "colour": "#8D3460", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842498, "uuid": "bb988120-9136-4e06-b085-eebb7a56007c", "value": "T1B3663377F4381AC4E42BE4BEB0601BD287A1231DE483D539D09239D871E2BCA5D9D69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842498, "uuid": "7f4dec88-49a8-4582-ae98-ac98306a45fa", "value": "196608:+ZfthiC1tafzN87Ao7hbl0uU+HB/OGUElH6XU8YYlbHXUs:+B/CLsAo7hRrU+h/PUEl0U8YYlbEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773842498, "uuid": "924c3015-936a-4b21-8399-fe53ba58589a", "value": 7066111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773842498, "uuid": "b17a8049-61b9-4294-be02-ad8d675c00a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773842498, "uuid": "c6109908-3bc1-4315-b775-1c2bb0adc76c", "value": "asfixsoftwaredev.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a18b7b-230f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773868632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868632, "uuid": "a3334d8c-e988-4904-9197-85c0abf152c7", "comment": "Malware payload (Mirai)", "value": "e03856040c3db2fb79e39db3f4704c4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868632, "uuid": "9fd3199e-ab98-4f7b-9f37-49d3d3589e9c", "comment": "Malware payload (Mirai)", "value": "fdee63a51689cc813fe877d030c10d7d4d973489009864bb6bae0ba2820fb6d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868632, "uuid": "20b72aa6-d089-4520-8e74-60d6c137310c", "comment": "Malware payload (Mirai)", "value": "b3e7bf7e627fe6a7b7d3de2b389b66cdc4ba0621", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773868632, "uuid": "9184cbf7-94aa-446a-bc20-2e4929c88f11", "comment": "Malware payload (Mirai)", "value": "37d89108ded7eab4c9c6be5c976d49a0cf5cfc856893fa8a69e904d1e84ddaf21cbd4e7211edd246aea6a42609726f42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868632, "uuid": "b9edd0b9-8f30-4e2d-997d-4e35b43f7ef5", "value": "T14A836CC6A683F8F5EC110578313BAB774BB7F53A5039DB86C7986833AC51680E21636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868632, "uuid": "2b507177-324a-4681-8d0d-284d1e57a270", "value": "1536:YV1aFG45B0pgFAQx1S2GaMPR2PhsQEct40G4eXojzb2Ruq1H4X7/9Ftrz9b:gQF36pgFAUsZaMPU2QEX/7YjYuGYXhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773868632, "uuid": "9bdf9488-5df9-4b6f-9273-75952f18edcc", "value": 88016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773868632, "uuid": "948d04e8-5778-4d53-bc1e-e69098049db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773868632, "uuid": "d12d6913-59ee-4ab0-b2e2-d70323a5da81", "value": "tux.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603b72a1-22e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773849109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849109, "uuid": "23fb73e7-98c0-4652-ba96-2c061a9ec78f", "comment": "Malware payload", "value": "e8234b03a404021ea2cdb36d243dc4d4", "object_relation": "md5", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849109, "uuid": "f021e191-d388-480c-8673-5b8a8fe179e8", "comment": "Malware payload", "value": "fdf8fae0a74fc5401e60864b8fed9be427b5cd4c12561c91cd412228f1a6491e", "object_relation": "sha256", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849109, "uuid": "020f1745-2e8b-4719-bfb9-382086ac86ef", "comment": "Malware payload", "value": "7f62605c8c08ca8ee25f70c29508f77e5007978e", "object_relation": "sha1", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773849109, "uuid": "e65c1e56-40dd-4bd4-8871-831f298ebdc1", "comment": "Malware payload", "value": "3fe6ac45555c01006c3efd1410987a0103cad2af2c9aa9c07e736796da80d846d00b483e7075e25f33429ed64b3ae4ef", "object_relation": "sha3-384", "Tag": [ { "name": "Cozy-Minecraft-stealers", "colour": "#050A51", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849109, "uuid": "76933f4e-f4e8-4fb7-a5a2-9c0228e6552f", "value": "T12E15CFC006E65B3D1A1E74A921656FBFCBCAF86C148C3595BF80F901DDD772842ACEA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849109, "uuid": "a3a38c8a-0360-4686-9c3f-be555be0beb2", "value": "24576:D8FFYTRei//UVR2GRbs8PPCSIvMGgXYLj8:D8FmeitGRbsASNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773849109, "uuid": "47a0fa8d-ec4b-4291-a9c5-6b4353428f94", "value": 945107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773849109, "uuid": "44aa648c-23a4-4fe4-9327-6dc334f02def", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773849109, "uuid": "6db3f253-0a67-43d2-9df3-1b7446ae4940", "value": "fdf8fae0a74fc5401e60864b8fed9be427b5cd4c12561c91cd412228f1a6491e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a3c72c-227f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773806835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806835, "uuid": "9cd53f98-4ab6-4453-9ab0-35524e713398", "comment": "Malware payload (Mirai)", "value": "7b91536cfc0c63077420a6fe27a927fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806835, "uuid": "ac9bb8b6-bd23-4c16-bb8f-894d40e64d77", "comment": "Malware payload (Mirai)", "value": "fed77d5d6d50cc5d1708cb0956d627e4d778ed375ea31631f53b5924dd8e158f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806835, "uuid": "0e3e24de-b7c5-4afa-ad80-4e0c4b68dca2", "comment": "Malware payload (Mirai)", "value": "4d1abf5189564a299bcb6ffe6bf0ba92a8749270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773806835, "uuid": "4b56e627-de33-4bf0-a997-1f01d52b51a1", "comment": "Malware payload (Mirai)", "value": "b7f3bed7fde43038ec0f5e850c90dd29287437bac3402bfd4e5aff0d064bb5cef9e72c9f9e5b5a8512301e3302591aea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806835, "uuid": "a9a2a59c-7ad5-452a-9ad4-df8e2461983f", "value": "T1E5144B45F9405F63C6D216BAFBBE828D372613F8D3EA71138D216F20378646B0E76A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806835, "uuid": "1ff51f97-f913-4bde-ad43-3f4329dc7df9", "value": "3072:nLSYWvBjb9lYXW2zdMz0Sx6UCpqaUoGtL46QLqUUJeO7CD9gcc:nLSYEJP2+gSqpqlxh46CqBJn7Q9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773806835, "uuid": "766da329-84fa-475b-890a-d4f1407fd049", "value": 197600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773806835, "uuid": "6a70a9c3-8f5e-439d-93b8-58fe90f90c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773806835, "uuid": "c54d0a44-8c65-4a7a-aa2b-726da9e2e35c", "value": "nuclear.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66de37f-22ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773825605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825605, "uuid": "db75fce2-e145-4a02-922c-096247d32d9f", "comment": "Malware payload", "value": "813784f1f1c9c7ff7386061b96745539", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825605, "uuid": "90864231-9edb-47dc-8042-89ead3151cc6", "comment": "Malware payload", "value": "ffbd3e25571494348392f9db5c353560fe433e73f5efdbaf3fa3d8b9cca5c010", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825605, "uuid": "1afd5168-b1fd-4a96-b4e8-19edadf529ea", "comment": "Malware payload", "value": "af77e15eecb2e42ccbee03813e464785716dd10b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773825605, "uuid": "92373a54-a84f-42a4-9f2c-261106223995", "comment": "Malware payload", "value": "22c1737e689469f9c0d6938437fa004533acaef0a0cbac645c1b74294754ce176e95b83eb68f79e73437d70ed6454e82", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825605, "uuid": "5673c90d-a709-4b94-af4c-26ec8a84b73e", "value": "T11C925BA916496C79BBC0DE7D9F3C7F0CADE8C1C02218A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825605, "uuid": "ab8874ed-e0cc-4361-8884-312f8196e641", "value": "384:G10M3vgRjGlsaq78zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:GtmjfYzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773825605, "uuid": "4a72ddfd-73df-4d0c-86a1-95558c50c5f3", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773825605, "uuid": "8f05bcd3-8d37-4546-9836-b902853cf778", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773825605, "uuid": "0bd01bb2-1d76-4b48-8638-4d766fa18c11", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc94834e-227c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773805456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805456, "uuid": "990eecca-9f96-405e-bb71-464580e70060", "comment": "Malware payload (ACRStealer)", "value": "97fdeea9f731845694296c3241a94a84", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805456, "uuid": "fe98cd48-068d-48a8-a05b-c6b0ea7c4c55", "comment": "Malware payload (ACRStealer)", "value": "ffd2f5c2d39b5b8d5d1d2754e91b1e6181384f05f8f7f4ddac07c6c13d9b97cf", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805456, "uuid": "fa7d6a57-c060-46fe-bcd3-1ee25a254cba", "comment": "Malware payload (ACRStealer)", "value": "11be16be8ff7a17ffdd4f03464ee9acc130575dd", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773805456, "uuid": "24ab711e-fd60-4e93-a719-cf02496b3d7c", "comment": "Malware payload (ACRStealer)", "value": "e588266782066a5c4ba34377bea3f4985221941e989c93eea14c2615994db692f0b7a640c97dbcb95ee395b7f0b0e12c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805456, "uuid": "16904702-e526-4f3f-afcc-49ce5b5beb6d", "value": "T1CF350A4A80C578E7E79341B365279E17BF3D05890AB6CC1A72EE41ED27A3AEC537B410", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805456, "uuid": "7e5e3869-59eb-464c-a697-9643e3128bf3", "value": "99a5df12fd7026009ce5bf96381f3043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805456, "uuid": "973aebd1-6a9e-4887-ac7e-ad0f6375103a", "value": "12288:XPO2YoU4P42JiiqQ2FPH+tS0qGOvHFW0wepmVPjYwEk/YILFlQihA5oRLtBCU:/OWRWbGKlwep+PjYwEk/YILFlQihsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773805456, "uuid": "8293a4a9-34a9-47f9-a59b-2eb47b070f9d", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773805456, "uuid": "205fa80a-36b0-4e4c-b24d-0e5ee6964f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773805456, "uuid": "0f1d047b-b211-4280-afdc-e300afc08811", "value": "SecuriteInfo.com.Win32.MalwareX-gen.19221216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }