{ "Event": { "published": true, "date": "2026-03-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-22", "timestamp": 1774224182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "387ab932-db3a-419c-b031-4cf556357dd6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2941b4b3-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1774160832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160832, "uuid": "e81b6f5d-2a10-4f09-aa24-b4a836fd588e", "comment": "Malware payload (Blackmoon)", "value": "a8240226113a49488468ea6d36b52130", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160832, "uuid": "61b84483-a92f-4df9-8614-02a3ec524b21", "comment": "Malware payload (Blackmoon)", "value": "002b87b5c4408dbc33a1cfbaf2c8568585e7a8bc724c8720706ec4e3b7ccf1ce", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160832, "uuid": "a66e1beb-0bda-479e-8f7f-6d4630eefc41", "comment": "Malware payload (Blackmoon)", "value": "2f88ce5e6ab790dce8fb0af43777183ae3a610c7", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160832, "uuid": "13038fd8-d37c-42f2-a2b4-b006a0b55d91", "comment": "Malware payload (Blackmoon)", "value": "49ef7ea79d927540a531c60d250cab5027a74c8778446a26c7cf89b45c22ed401a744f2d6884604976d0744b740e9aa5", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160832, "uuid": "9de78788-fb81-4b84-9ddf-8026765617c9", "value": "T1A9A4A6B21F3DE5B7E6B0F47056A91164288EB67799C919F050E223880B79CC1D9C2DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160832, "uuid": "2ad68d57-700c-4c8f-9521-c08667439912", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160832, "uuid": "b748ceed-8ea8-4bc0-8482-59b04a71c789", "value": "6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160832, "uuid": "64e9bf76-5e14-41b8-bb21-ff7573b06e37", "value": 469758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160832, "uuid": "6f881bd4-fa82-4fdb-983f-35cf8980cd9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160832, "uuid": "f4346323-234e-4d39-a256-c1181db4ffc8", "value": "virussign.com_a8240226113a49488468ea6d36b52130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4416a897-25f3-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774186217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774186217, "uuid": "cba1a11b-fff1-40aa-9f20-2efe408265a1", "comment": "Malware payload (njrat)", "value": "4b7dfc5c0a312473b1f22ac5acddae61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774186217, "uuid": "bcbc3874-ad5f-4f6f-8cce-8215960041dd", "comment": "Malware payload (njrat)", "value": "0058557c0bd9a428de5df05dc49e9366471bc5d2ea3a738b6629128bca417af4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774186217, "uuid": "81af6391-ec97-44a3-9b9a-af05e2b86317", "comment": "Malware payload (njrat)", "value": "b6241fe025e1cf12f1f2198b78386b62bf8048fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774186217, "uuid": "76d2064c-8128-403f-aef0-6209dde2f2ce", "comment": "Malware payload (njrat)", "value": "b387901a450ab723ba7d887e8817fba1a26926e1a18112589b77dce1d152ccb257aa123397658b3c5cd4700206962545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774186217, "uuid": "0327d99d-bf77-442a-896b-cbe918babe22", "value": "T127634B4877958A15D2BD2E7844F296518730E50B7D03F72E4CD160EAABB3FC44A42BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774186217, "uuid": "16c72625-5669-4f7c-a127-e69ccca99629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774186217, "uuid": "db8d3d40-aa14-47f9-866b-a07cb4d667d6", "value": "1536:Rt22goN36tUQviFw1W+ZgBnvAbfLteF3nLrB9z3naaF9byS9vM:Rt22goN36tUQviFC76BngfWl9zKaF9ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774186217, "uuid": "d3b62c28-7891-4cd1-b25b-9f689979b037", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774186217, "uuid": "25dff628-15a1-4f36-b9ab-e4138d2b20ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774186217, "uuid": "00531416-e361-412d-a411-ad83031a009a", "value": "67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78eb346-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774161151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161151, "uuid": "1af56156-94f5-4734-a077-773d99614777", "comment": "Malware payload (CoinMiner)", "value": "fbccb64ff99e1706c618c8b45f99e660", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161151, "uuid": "e318d99e-e107-4f8c-a8e5-243025c6d39e", "comment": "Malware payload (CoinMiner)", "value": "00bba2efa9e9bb020828cde686e51ea3a39de47dabf65f197b18e957257f69c0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161151, "uuid": "f8832359-bfe0-40c3-ab32-44538bc33887", "comment": "Malware payload (CoinMiner)", "value": "6cebad0114bee1ec003857ff8e9c6df9b4842a4d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161151, "uuid": "40ce2691-1dc3-4097-9707-d1a2c117147b", "comment": "Malware payload (CoinMiner)", "value": "19b94079589e8db56a7f9a13a4605bb50e7d624198f4ae6b08c67c052a43c61e5f6f5779827b257f2b9bb6f954696ada", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161151, "uuid": "e3e64798-361c-4c95-b32b-bb9576f5d18a", "value": "T110565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161151, "uuid": "98586eec-3d90-42c8-8648-ee326dfb4091", "value": "c782987849999c5ae345a5deafbd73fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161151, "uuid": "528a38e1-1620-4229-a593-7cda649b37a9", "value": "98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUq:T+q56utgpPF8u/7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161151, "uuid": "f6fcc865-5324-4a81-a351-0c4611187405", "value": 6363753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161151, "uuid": "0945cbf9-76d6-4ef9-88e7-32b67352589e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161151, "uuid": "2b95eb92-911f-4a84-a4b6-118201105c62", "value": "virussign.com_fbccb64ff99e1706c618c8b45f99e660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c88c31b-25e5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774180138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180138, "uuid": "17cfd9a4-ee29-4abc-92f1-df0a420de704", "comment": "Malware payload (QuasarRAT)", "value": "78f2b131ec926e94c326c2ce0e70b8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180138, "uuid": "c5cd5486-b4b5-4486-aa38-8d3c59fb2f80", "comment": "Malware payload (QuasarRAT)", "value": "011872f14b1024cd6873aded365f0ff3e73e42c2ea1d7f7e55fe5daa43f27e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180138, "uuid": "6c4d7258-2577-4c70-9327-b441795542bf", "comment": "Malware payload (QuasarRAT)", "value": "e09f511431f0687a081a50120e9c0a84c42f7f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180138, "uuid": "13b8be87-8106-44f2-9028-01c83f3e604c", "comment": "Malware payload (QuasarRAT)", "value": "f882fbbda13bb7a5c4e6ba3f69ba6aa3539197c4837bfaf7be31f4465da51f5a34c393986afb5f27353aa32c66710fb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180138, "uuid": "debdd920-ee17-4978-aa80-6bc5bc8a3ddc", "value": "T119E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180138, "uuid": "42b5c6d2-3ab3-434f-8734-cb15b655c52c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180138, "uuid": "1e818035-ad37-48c7-b657-c921b8129c70", "value": "49152:zvTlL26AaNeWgPhlmVqvMQ7XSKRsRJ6PbR3LoGdDTHHB72eh2NT:zvJL26AaNeWgPhlmVqkQ7XSKRsRJ6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774180138, "uuid": "52e73bfe-a174-4dd2-88ed-5eeeabfeb380", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774180138, "uuid": "bb861a43-16ea-49ce-93e5-77d43310ec5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180138, "uuid": "b45580fa-d286-4d1d-a199-99d019d8bdb0", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562f712a-2599-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774147593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147593, "uuid": "9ac5e346-2406-41c8-8f82-8bfee866b707", "comment": "Malware payload", "value": "531bbc779602de78cd933a87c3dda65b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147593, "uuid": "80e79f04-d815-4cc3-8da3-e6607dcbccaf", "comment": "Malware payload", "value": "01c953bbe63d7fc1fb822154a034b2df3b477a0e04983d52333a5699864e4e3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147593, "uuid": "5f146875-d196-4136-9402-3f9b1851cc74", "comment": "Malware payload", "value": "45e655f0192ff2c2c290c4daebcd348b643ddba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147593, "uuid": "dc7939c6-2a92-414c-8999-69486580f58a", "comment": "Malware payload", "value": "fe52cd36dd7f0d2d38f23bf98fa55b84523f061ab4b97e9778ccf3417518ecae018f1253de09fc50150f0d8570f340e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147593, "uuid": "6566beff-8896-4462-9eb7-0a4b2009134b", "value": "T10118E01763A116AAD57BD1348BAB6503EA72B4071330C7DB329C03752F73AE45EBA760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147593, "uuid": "808d007c-074c-4e67-9dc4-e7bd4efee968", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147593, "uuid": "e0fa28d1-940a-4e2a-b9dd-2c204c170191", "value": "1572864:a6oslbkJI3UmrPMINIC+QLZvcgyAfCrrE7574O:XXkJI3lrUyRCgyA6r47J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774147593, "uuid": "698febcd-9528-4558-856f-bbf227a3947f", "value": 87342686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774147593, "uuid": "073b5187-0527-4c31-8bdb-a0628dd3ae9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147593, "uuid": "0f79451d-db41-4fe5-a56d-8cf1e87f8de6", "value": "ViperionV4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc22f34-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1774160648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160648, "uuid": "61195443-6345-4fdc-86fe-65793585ef09", "comment": "Malware payload (CredentialFlusher)", "value": "18e64581133201f588fb25f9397cf560", "object_relation": "md5", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160648, "uuid": "94b447ae-cf95-4f2a-8c0a-64c8e7877dc9", "comment": "Malware payload (CredentialFlusher)", "value": "022f4e13772804cefc83e1e9ca2d7df0c15fb8dfe9b16e6398d2646b1bd058f4", "object_relation": "sha256", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160648, "uuid": "e7e912c1-ea29-4ea5-9aa9-f7fc353f6744", "comment": "Malware payload (CredentialFlusher)", "value": "79cda6dd527f5e173d7ae3228a008405dad47763", "object_relation": "sha1", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160648, "uuid": "0f7e91a3-7dfb-492f-b81e-4144a8a15074", "comment": "Malware payload (CredentialFlusher)", "value": "2e5ed22217087b31ad6e3e70675ed8f75226376687a50729b08d78f5c0236839a275be40d193b2e5513507ae87b0f226", "object_relation": "sha3-384", "Tag": [ { "name": "CredentialFlusher", "colour": "#DA52E1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160648, "uuid": "fbf0495d-184a-4fbc-9b6f-c6b7251fadc8", "value": "T1DD259E027391C062FF9B92334B5AF6515BBC79260123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160648, "uuid": "f964dee1-97c6-4b32-9bf9-531ec46cc010", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160648, "uuid": "1b2fbf67-4592-456e-a978-68da6935832e", "value": "24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8aa0pxW:hTvC/MTQYxsWR7aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160648, "uuid": "077ca9b8-864a-4608-9fee-cc00e5b4e5d7", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160648, "uuid": "a0a3efb5-dbd5-4e8d-99c5-f93b71dcd27f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160648, "uuid": "59adcba9-b110-4a7c-b27e-e688763abffd", "value": "virussign.com_18e64581133201f588fb25f9397cf560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf6f69c-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160727, "uuid": "664c94dc-a251-490c-84e9-5dc6ebd2d092", "comment": "Malware payload (KawaiiUnicorn)", "value": "54b941d5e5ecc3119a68ec005ad095c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160727, "uuid": "e356905f-5150-4cbf-ae4f-0456da97e26c", "comment": "Malware payload (KawaiiUnicorn)", "value": "0246d68cd1a0f41cff1a3eb5eedbf6b31c064ba0290bfbc41bf05286e2e2b8d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160727, "uuid": "0a78ead0-03d7-46ec-80c3-34450277ade1", "comment": "Malware payload (KawaiiUnicorn)", "value": "0abde2648fc42de31d9ea4d9fe198684170b7e0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160727, "uuid": "993460bb-b6c3-4a11-a629-bb949816544b", "comment": "Malware payload (KawaiiUnicorn)", "value": "45e7c120a176089c9708da0694460eaf81b69752e3e91f043c7b078a8b0d4b8d113e8ebc5b1d407531cb5889934b042b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160727, "uuid": "9d629d95-69b0-4979-84be-9b01cd3888ad", "value": "T167A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160727, "uuid": "bdd683ef-7118-407f-b108-3136098cc3dc", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160727, "uuid": "a67819c8-4ea9-4738-8d22-fd41a7238300", "value": "3072:1p6FVfPOay8Unb/EPO5FffyvHVLhI8zVmHgtbVHaEbHXfSIKFCb:1poVrLUnoPqFffexxXaETvSIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160727, "uuid": "500ca30e-5afb-4101-b40a-e0d706737865", "value": 479272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160727, "uuid": "00da1d7d-ae64-4927-986c-421027ab47d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160727, "uuid": "89a3034f-0ab6-4a42-a48f-7135a3a5f61d", "value": "virussign.com_54b941d5e5ecc3119a68ec005ad095c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4406d6cc-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208980, "uuid": "7d60319d-c616-4006-b02a-d19184c2aa7d", "comment": "Malware payload (Mirai)", "value": "643ff6fb7011cf65f9f8e56412922b17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208980, "uuid": "d96df9f3-5e5c-4927-9eeb-dd226f39078c", "comment": "Malware payload (Mirai)", "value": "03b36e3abd751b69530806a45611ddb81841e7ad414ab076ae20b1ea3991987b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208980, "uuid": "247d31ba-3b53-4e33-9494-4bb9c999fd8c", "comment": "Malware payload (Mirai)", "value": "3532c1674f3215e0460e406c42f72948eff87a2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208980, "uuid": "ce0e9f1f-207b-40af-84a8-40a759737815", "comment": "Malware payload (Mirai)", "value": "f63a5934e934e339a4c7973880539b002a5ef7ce87aa2aa41c3a3b57efbb398952378d2291d4f781b8eb20e3cfc113e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208980, "uuid": "8f5a7b75-700c-4dc4-95f8-f3943349d8fe", "value": "T148B34ACAF800DD7DF84ED77B44A30A0AB571A7914A830B373267BD67B9310A55827E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208980, "uuid": "6e4e3741-12e0-4f46-af4d-83df72a8487f", "value": "3072:FBCU3oYgfVHBFyjWadHAk/XKPyJC1huOK3+1qOwiM1i8:FBjYYgfVpVPyJEhuL3UMw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208980, "uuid": "0da7494f-70b6-434b-912e-c0baf8786fa0", "value": 108276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208980, "uuid": "15d9980f-671d-49c7-9da4-44cb2523e875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208980, "uuid": "b5343000-abd7-414d-b5cf-ce5e960dfb31", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cdf9ad-2586-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774139373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774139373, "uuid": "f1d3a640-c7ca-4175-9dfc-4a7bdd485329", "comment": "Malware payload (Vidar)", "value": "db86437c634ac232a962ec86ecac55ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774139373, "uuid": "84066642-742d-4253-9bbe-fc0d80938378", "comment": "Malware payload (Vidar)", "value": "03f44dd98bf2c2a9fa5f683f061f2bd0b35d0326c61b71496299848e91edd612", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774139373, "uuid": "9f08dd36-715b-4a02-8608-4a71b6fafc27", "comment": "Malware payload (Vidar)", "value": "9856928cbcdc005140f13ef0d43a2f2b624998f2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774139373, "uuid": "affa589f-f91f-4fb9-9d69-b5cde1e0cffa", "comment": "Malware payload (Vidar)", "value": "f95babcd42ddc22d118da44b94d726ded4df15f355f4bdf376019dc24cef4309afefc4600294ef59b646cbc4d38727ad", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774139373, "uuid": "85e48028-fb51-4a5e-8fed-00a838b8a27d", "value": "T1F7D42BFE9D60E325F60DD0BAE247D7528F2138011236A6A329BEA3141245873DB677FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774139373, "uuid": "92735bca-d780-4778-b9e2-ddbfaf6a1bcf", "value": "12288:rkauuPSlU5B0umJF9Iv/ht+JSe9gke2nHDxH1Wg17RWc:QTuPSlUzuj9Iv/q1PGgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774139373, "uuid": "41f192b6-a552-4bd8-b17a-6856d44694b3", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774139373, "uuid": "6e6b5674-bfe3-48eb-99a3-008202f05450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774139373, "uuid": "c3559970-ec51-46b7-be84-e5f3a1fdc63d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22c822d-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161088, "uuid": "1564e16a-e804-494c-907f-bd880faf125d", "comment": "Malware payload (Berbew)", "value": "e721d927d3235d53c66d7e3420a77ca0", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161088, "uuid": "3aa26a8e-dbc2-4b5e-992e-7041b7874dcc", "comment": "Malware payload (Berbew)", "value": "06192a6eed800e6ca168ed4cf259aa45b891a3d95f31be030a943a96c7d5a2f9", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161088, "uuid": "e1b9facc-0c4c-467a-945a-c4820032bcfd", "comment": "Malware payload (Berbew)", "value": "8e27afec6540bef84487929645c33a08b8e0806c", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161088, "uuid": "b7612b95-3d56-49f2-90e9-c28418ad0974", "comment": "Malware payload (Berbew)", "value": "51e050183662d16d50ea22b66b5f6ae6f78d338658ef839c0de2131f64679c3f3d34c6dffb0ef626fe0b5fc621d11bd1", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161088, "uuid": "97a7d446-4562-4d33-b0b6-bc9eeeeb1838", "value": "T163639FF618545DAFD96A06BCDD2C04689870F63A040D7DC712F8F59C8BA7AC883D6F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161088, "uuid": "cff264ff-fd89-4503-a9ca-c82b031c6b6a", "value": "02a702ad162c3a8a4d8bd0bfd0ad831e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161088, "uuid": "c0981376-801b-401f-997c-4c4775a1cc58", "value": "1536:PmVTLQmd/dLBVevzUVQXF/7oOR9ZPTMUcRQXRbR:PmTdBDevzUVQGOnceXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161088, "uuid": "b5a85e06-5f16-4895-94d9-a0eab19f90a9", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161088, "uuid": "eaa9757c-dede-43c5-b443-50b77ffeb57e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161088, "uuid": "9d550d51-42fd-4056-91a4-17f2cb01e6ce", "value": "virussign.com_e721d927d3235d53c66d7e3420a77ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b28c52-25f8-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774188317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774188317, "uuid": "7425475c-51c3-4fd8-82fa-4a101f4cfc69", "comment": "Malware payload (njrat)", "value": "e5add4e94950bd6d5da3cbe3751c34ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774188317, "uuid": "1a3057b0-25e3-4921-9519-2a92ac5f4771", "comment": "Malware payload (njrat)", "value": "07723b370734738ab6eaf57979c8a26a30a04775ce38e4509885e302020e815b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774188317, "uuid": "9290e4ad-27c7-4305-8c34-61a6ea1dc52d", "comment": "Malware payload (njrat)", "value": "38d16a0008ec6f2e68c295ee500b84ec46363d36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774188317, "uuid": "55c2e26e-ab7e-431b-a893-8480bae389dc", "comment": "Malware payload (njrat)", "value": "1a2983fe1a882b15952c4ad21eae9f6e5e75077f618a90815f8e1c127a45f1a4df04417ca5fa2ba220fc0f3eaf70b2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774188317, "uuid": "26eabf21-9e1a-4531-8db2-3d6330d2ff90", "value": "T186633B4877958A15D2BD2E7844F256518730E60B7D03F72E4CD120EAABB3FC84A42BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774188317, "uuid": "54c7ab46-ec1a-4958-8f44-37ddd28c15da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774188317, "uuid": "ee5d3a4d-b363-463e-8c74-920e46e39563", "value": "1536:sl22goN36tUQviFw1Y+PgBnvb8fLteF3nLrB9z3nnaF9bKS9vM:sl22goN36tUQviFCFIBnAfWl9z3aF9bS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774188317, "uuid": "fe234187-8032-4d4b-8bf7-d623114f88ea", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774188317, "uuid": "5ea8d322-8976-420e-9935-9189952d6548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774188317, "uuid": "e6e4d923-5079-483f-b547-6bada295aaed", "value": "kasperskyANT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821d625d-25c7-11f1-a769-42010a9c0008", "comment": "Malware payload (PythonStealer)", "timestamp": 1774167423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774167423, "uuid": "579b1dc5-0620-4ae4-947e-fc6cc757aa06", "comment": "Malware payload (PythonStealer)", "value": "746e83698beaad8113a334c7ebb1ef0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774167423, "uuid": "6e88d181-fdf8-433b-abdd-2a8405b08349", "comment": "Malware payload (PythonStealer)", "value": "0a3a4e59ed20a0bbf6dc223c022936d4d10725e289b29736355cf88c253c1636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774167423, "uuid": "7de83a9c-ab3f-4dc2-8452-fe05c4ab0ffa", "comment": "Malware payload (PythonStealer)", "value": "eb0e67d71b160a59bfa5e734a390505778ecfd18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774167423, "uuid": "e9e085ad-3aa8-4deb-a2f4-0e8c36424c30", "comment": "Malware payload (PythonStealer)", "value": "e5670de3ba7d7608caab5e8e24d5bfdf705675ea2be75b7ab7d20f1bd835e6299c39bafc535e9bd1193cf9e1b4235da9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774167423, "uuid": "75064ab7-90d4-4587-953f-af34403de8b1", "value": "T117B63329FF62AC6DC13723F14956FAB023A5BCA41210E16B52F1EE63F3E71914E056D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774167423, "uuid": "f9e46964-5ab6-40cf-aaa0-fcfbe8604831", "value": "48f89db9caa646e3b8f9768987f6455e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774167423, "uuid": "88fac4ec-8ae8-4294-b577-d3201c38dd61", "value": "196608:6YONR0sQ6LOw9u1zB3WEs536M+ZfOCQh/fACUXaqDIu/jVaZ0yOz0LD5FO:9E0s1Hu1zBLnM4fOhh/fMXaqFjVaOyN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774167423, "uuid": "060ff064-b81c-4786-90eb-a4cad5a66c33", "value": 10578944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774167423, "uuid": "63348cb5-48d6-4b82-bbed-b8d69888113f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774167423, "uuid": "4b159b0e-0db2-4561-affd-c3b2390794c2", "value": "CyberGen_Stealth.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b181da8-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774160969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160969, "uuid": "326cf309-571c-4fa0-887e-0f36e39cd656", "comment": "Malware payload (Snojan)", "value": "c136eb87f379f002fa9b245245d6db10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160969, "uuid": "6720f6b2-e46b-48ec-87f4-d723d016a6a9", "comment": "Malware payload (Snojan)", "value": "0b35f71757222ab1e86335db014562d98a5eedb456e04266c3ed90d442b04151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160969, "uuid": "e6b757f3-318b-4c14-9c28-4d2184127316", "comment": "Malware payload (Snojan)", "value": "0d05b953030757794e4682121dbfdc543775955d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160969, "uuid": "10d0836d-cd46-497d-8f23-fa9410311f56", "comment": "Malware payload (Snojan)", "value": "3982346931e853aa31a52fdac7e1165ac085ad71c281db10c266b15811c33b0be27cf64198bd6fdd0c7a2e3d69aeb7ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160969, "uuid": "5c90dbc2-c9dc-45ae-a4a2-f534c1d81e60", "value": "T1CC345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160969, "uuid": "fccfd2b7-6bb1-44b5-b2ee-063fb4d1f598", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160969, "uuid": "818e18d0-dab2-4ac4-b4e2-e325dd7c7c97", "value": "3072:8J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/j/FnncroP9:AwDeM7iNEkgiOb31k1ECjJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160969, "uuid": "3931e7ae-5cd4-4cc7-b2f2-57838727220f", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160969, "uuid": "cd041c44-4b5a-4973-b291-00dfafeef7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160969, "uuid": "54b87def-5838-4edc-8344-a1601c8b852f", "value": "virussign.com_c136eb87f379f002fa9b245245d6db10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94d9f69-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Installcore)", "timestamp": 1774161073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161073, "uuid": "f72865e5-f623-41e2-8ce8-d7fb1a870dd3", "comment": "Malware payload (Adware.Installcore)", "value": "e3ff8593829a9c8fb976c964cac697f0", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161073, "uuid": "ed07fbe0-4266-4d93-94f3-7c16086f059b", "comment": "Malware payload (Adware.Installcore)", "value": "0b58bbe496218fa82f98aff8990622ed7529bcbef31c2b782657a80eadccc734", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161073, "uuid": "79aa77ef-3e88-4f13-b923-3cf6150125bd", "comment": "Malware payload (Adware.Installcore)", "value": "4e3eb008ce0fe14cf8b79d08e55905f68e8b9a84", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161073, "uuid": "8b380d0a-f137-4a99-8fde-0808f2c9a7d7", "comment": "Malware payload (Adware.Installcore)", "value": "991712e8542e5a14262133fdabdf201a446be5810683fc2cfde94e2ba49da5dc8956ff446fbb1710c34ee51c5a6e2822", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161073, "uuid": "8ed79103-7cf5-4688-923b-a2857da1644e", "value": "T1FFC51203BB4A61B1F159193600BE060ACE16B82C2FE2075B7D39F76EE5B62C25E37355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161073, "uuid": "d3b94550-52d0-4c78-b720-aa014e51c1e9", "value": "48aa5c8931746a9655524f67b25a47ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161073, "uuid": "df2db827-5f3f-449b-b17d-5766e2a611ed", "value": "49152:kNCrEYnfuY9A6zkMucUtCOUN1N0lkrdXz1iOKfee5WjCtHfQEzWMmxs+9:rrXnfuY993lOUNIlkrdoOKfee5Ht/QEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161073, "uuid": "72e9540f-35f8-478e-a858-70ee0713203d", "value": 2503856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161073, "uuid": "4343dc1c-ad2f-4443-a6fe-45a945e2eb19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161073, "uuid": "08c58859-4fbc-4cc6-b56d-781ca27701f1", "value": "virussign.com_e3ff8593829a9c8fb976c964cac697f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691e5796-2626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208183, "uuid": "616bbdb7-427f-4806-9b8a-49f3b377106b", "comment": "Malware payload (Mirai)", "value": "802bc37e4d5583c76a2b3e68259fbf8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208183, "uuid": "5cabc91a-3634-4845-a368-fa6228758d15", "comment": "Malware payload (Mirai)", "value": "0bf3297ac998d608607d613fb993eb1d2a7e8f21f03c7d30ff9b3b692fa2d4a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208183, "uuid": "0adb3680-2d4b-4bf7-a4ed-f6b240580107", "comment": "Malware payload (Mirai)", "value": "553c0a0c6343d6a8ae77234b7840a2fa58a7d904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208183, "uuid": "567d760e-7d81-4a6c-8b9c-52a0adad0956", "comment": "Malware payload (Mirai)", "value": "4caf1b4a18a31ec20447e97aaf9e95895032ad6fcff2856457b22dc938a9c63f931aaa92fcf2e0c038092a1e690195a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208183, "uuid": "45365594-892e-4f9f-857a-53a7a67449d8", "value": "T1BEF339C1F64FD4F4E95601702027E7379E32BC76013EDA93D3A89B32AC93651991A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208183, "uuid": "43903b17-2f6d-436f-a247-80deb55f1705", "value": "3072:QFrp038VSwHemAX0On0GKSy70E4W13nEOe6XhCSCysSuxr9gwP:QozwHWXJn0GKSyoE4W13nje6iSShHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208183, "uuid": "556cebbd-67b9-49bc-9f15-b528dcd104a7", "value": 157868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208183, "uuid": "d44436d9-557e-496d-9463-713778002c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208183, "uuid": "a5740e62-8abc-4721-9183-8efbfdff542f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a285e5-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161017, "uuid": "34fc53a1-d480-4616-bd2d-36082bc8ea9c", "comment": "Malware payload (Berbew)", "value": "d2ed452cbae63978da0b17b0a8767ce0", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161017, "uuid": "03977354-4347-4893-b986-5559b7441af5", "comment": "Malware payload (Berbew)", "value": "0cf7ec4b73687bf9b5caabffa40038e613f6eba2456335a316367edf594f59be", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161017, "uuid": "1f06aec7-26ad-45cf-9087-aad65232b622", "comment": "Malware payload (Berbew)", "value": "6a3ebe8519e58a07781c5f5b76f3ec2eb78c523a", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161017, "uuid": "2d868234-4ee7-48ad-b6c1-c92635881b5b", "comment": "Malware payload (Berbew)", "value": "8acedc27604f8a538c1a2b4ab52072b1cf7b8faca772042e90ed8a5c8c3190571c364522a5450fe6f2874baa5c623624", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161017, "uuid": "6bff9622-dbe4-4939-8bbd-76319e964786", "value": "T198346C6FFD4A2F7EC19102F13E0758F5A22B8E35666AD99310785D1D12A3F17C2BE284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161017, "uuid": "ff128a01-adc0-44dd-a31a-41801256aa64", "value": "a30eaced0d06a4960942da11db99bf06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161017, "uuid": "78b63ffb-1570-4553-88eb-0fb2d08c3890", "value": "3072:pr1M0SJmjeSoj++FeydpwoTRBmDRGGurhUXvBj2QE2HegPelTeIdI7jFHu:pr4JmRw++o3m7U5j2QE2+g24Id2jFHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161017, "uuid": "d89d79f4-3273-4f31-a19e-00b1a2c9e3a5", "value": 233217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161017, "uuid": "5d428046-9577-468f-93d0-f83458f4cb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161017, "uuid": "efee28bd-2fab-49f9-8c8f-728a58ddf34b", "value": "virussign.com_d2ed452cbae63978da0b17b0a8767ce0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f090f83-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160492, "uuid": "9f73a992-26ec-4cad-bd7d-4f94c5742a47", "comment": "Malware payload", "value": "8bf0bb8f5a088d01d6158826f327d2a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160492, "uuid": "d1f3968f-6d83-4a41-9b70-7da5d999bc36", "comment": "Malware payload", "value": "0f7ba594fe8081bdba9f2ac67924fa7ee776a75b94ab7900b7e78ee9537fc495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160492, "uuid": "895e78a8-abb4-4091-874b-23017016efa2", "comment": "Malware payload", "value": "0b7cc2ce4bb812c6463c8b3d146d7d348a5e9f6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160492, "uuid": "b9c3b0f0-eec7-49c4-9428-b7fa07ecbd9c", "comment": "Malware payload", "value": "bc3c514ed2ba02e16f29599a64a6998d552a88ffd38115e4fa1017cb2ef79c14608420784890c18d9fb72d2082219b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160492, "uuid": "e473450f-2118-4cf3-9b1b-ec1f5d210bc9", "value": "T1DFD47C1232918572E8826FB398A397C96B7B3C547E19E15F1E4470DE9F7A3811CBCB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160492, "uuid": "c9633a13-6a57-4526-9d93-642c8d85c8b4", "value": "9efd8dd4111e58ac2448f26c2a3092f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160492, "uuid": "4723ef03-d86c-4f90-88eb-1043286d8745", "value": "6144:qzy/vfpI/YL+zLiyevOZfSqb2daY+72zRvTbZzg9QtQMrQMznUt:qmLeiyeWpSqCdaY+7ERvTbZBQYQGnUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160492, "uuid": "b62e4e2a-ff9b-4f0d-9562-257cd604c0b4", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160492, "uuid": "93b4ceef-0167-4285-b6d0-c1a873f94da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160492, "uuid": "9d072dfb-b09b-4f6c-9337-25e267217943", "value": "CretClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ac4bb8-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Dyre)", "timestamp": 1774160577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160577, "uuid": "eadcf4d4-9599-46f4-b73b-7b43566dfe9f", "comment": "Malware payload (Dyre)", "value": "4ba43f0b82f86efed437c8523f7a4dee", "object_relation": "md5", "Tag": [ { "name": "Dyre", "colour": "#94FE03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160577, "uuid": "a532953c-d1e6-4857-84b5-3a2c22753492", "comment": "Malware payload (Dyre)", "value": "10745182ac1b738e4a363166f650069d16b81873b3bbb1990e7d07cb652495e8", "object_relation": "sha256", "Tag": [ { "name": "Dyre", "colour": "#94FE03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160577, "uuid": "3e130425-f352-4fcc-8077-07c2ead28cb6", "comment": "Malware payload (Dyre)", "value": "356b21b749c8bc5e2295a3db62ea03c47cb4c1cf", "object_relation": "sha1", "Tag": [ { "name": "Dyre", "colour": "#94FE03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160577, "uuid": "9b038061-89d6-43c5-a08f-aeee2908e6b2", "comment": "Malware payload (Dyre)", "value": "e60c1d27760fd0d22dd3353d85e501987d2c80a180a229c514ff32e3c157b7fa7759160cb9970381936baf9e447d1129", "object_relation": "sha3-384", "Tag": [ { "name": "Dyre", "colour": "#94FE03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160577, "uuid": "827b4d9b-6830-4366-a210-19dc67367612", "value": "T19054C413E3BC44FEEAE7857F5A085DDBB217E0F16B95E6C2C8D9929888D358D5ED0080", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160577, "uuid": "ed76bc6b-4b9e-4f2e-8d25-6e8d8cf9be93", "value": "000c0cc51cebb7ae0df3751e56dc52b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160577, "uuid": "14d1029d-388e-47e9-98e8-90848e878a8c", "value": "6144:NYIPjoJyR6dNNdUvw9IbxQi2qJ+4DhYxrtaDi:NY/eP9j2LvxaDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160577, "uuid": "a0f90333-55e1-41a5-8909-d5f5daf11925", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160577, "uuid": "f3ac48b4-5e60-426a-bdc2-c831810b5111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160577, "uuid": "93ffc06d-03c2-4497-914d-642eb5be34a2", "value": "dyre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644937e9-25e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Viking)", "timestamp": 1774180688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180688, "uuid": "bff6dbea-ea80-4d62-885d-5b98b8569d4c", "comment": "Malware payload (Viking)", "value": "4e5fcee0a8e76f515edcc499f044cb5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180688, "uuid": "41be384c-f601-4ce8-8cec-2b58d078d46c", "comment": "Malware payload (Viking)", "value": "1273d537c7dd3abee3fcb02e94d75f12935e1b546847ee715988bfa7de48f4ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180688, "uuid": "79b3df7c-bfab-4131-96dc-65b655a0f5b7", "comment": "Malware payload (Viking)", "value": "f757ed5cb0164261b235f91755f681800bfbd4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180688, "uuid": "1273163c-8de5-4682-8b14-4ffa2d8ca818", "comment": "Malware payload (Viking)", "value": "133beb5415fed76e27d7c7870bd46ed230505f9a234be0e80af9fc8678dc68139880e06439cd2bcb0aef92904355f3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180688, "uuid": "fb250cac-4b95-4619-8e0c-54957997a652", "value": "T147C41916F6748335D073C0B9C5D2A68AED7134825B308ACB4296D77C3E67BE6863A731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180688, "uuid": "38fb0731-b9ef-47e2-917e-80e4e655a2f2", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180688, "uuid": "ef7cb9a5-7f16-435f-af94-9893fe976d82", "value": "12288:E3NRkXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:E3NRk0Le5ji0hmxNrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774180688, "uuid": "5602661d-0dc7-470c-8ba8-b40dbb7fac6e", "value": 596625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774180688, "uuid": "b0a79c6f-ac9d-430e-b47b-5e2f926ec339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180688, "uuid": "8a641915-eb36-41ae-bdb4-2afa07f73c96", "value": "1273d537c7dd3abe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c71564-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1774160744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160744, "uuid": "ffc64b4c-5278-4e75-8096-627e5e547def", "comment": "Malware payload (Blackmoon)", "value": "687ba9e13a6fcd68ba9cf866d0f58b40", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160744, "uuid": "32b1ed10-e2b6-4608-a4bc-04848aef6e77", "comment": "Malware payload (Blackmoon)", "value": "140bb888bd7c8734184cbb0329e2a50e73589a5e4dc50d8286149ce03af9ec7b", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160744, "uuid": "e711cc62-0b42-42fd-9c03-083c1f000a9a", "comment": "Malware payload (Blackmoon)", "value": "31e23a41759999c4b197ddc0e8fe727f4a0282b0", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160744, "uuid": "d3a3fbce-8635-4f7f-aada-03b4a39a8c99", "comment": "Malware payload (Blackmoon)", "value": "588fff85b284d26925315041dc426471684eb3d3f3239c9abe7d011634f9471633606786f90f9a2340cba48e30d4ab38", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160744, "uuid": "1c48ab69-9b14-410f-86fb-c15e7c7bdd23", "value": "T16BA4A6B21F3DE5B7E6B0F47056A91164288EB67799C919F050E223880B79CC1D9C2DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160744, "uuid": "6ca10902-81ca-408e-8d79-0092542a8ef1", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160744, "uuid": "cec5b384-bbaf-4269-a70a-7dffaced4a82", "value": "6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbexcnS:q7Tc2NYHUrAwfMp3CDKnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160744, "uuid": "f72f65c1-9a64-44bd-ae33-ad3c7435eb2d", "value": 470381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160744, "uuid": "f40e84e8-11d7-4ba6-89d7-ee01c2899124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160744, "uuid": "f604ccb6-01b4-4c78-a319-8ffb9225b91a", "value": "virussign.com_687ba9e13a6fcd68ba9cf866d0f58b40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab302f4-2610-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774198871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774198871, "uuid": "0d434f14-3032-42f6-9977-e607197e264b", "comment": "Malware payload (ValleyRAT)", "value": "c490659944e7a0e96cc158692c6b0d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774198871, "uuid": "cb090165-f3f8-4e89-ad29-c419240c999d", "comment": "Malware payload (ValleyRAT)", "value": "1447b57a09a8759ab98c8958b655ed082388bf562261477664f9e90ce87ac2a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774198871, "uuid": "531d61a9-544f-4a00-8035-9bd72364fbdb", "comment": "Malware payload (ValleyRAT)", "value": "3802ab2c84fcb57e1314f2aebdc0f63e65adbbdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774198871, "uuid": "38c97bfb-67c7-482f-b600-543974de7092", "comment": "Malware payload (ValleyRAT)", "value": "1d3d6a8061411cf225707acbaf738a7a0f4ba30ec8dfa94aa068b8f6facb9f5ca21ffe1fbad713c5609846d3fb05b18e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774198871, "uuid": "2244e76d-c141-4935-a482-612a553661b2", "value": "T14925E151B7A1C0B1D5B715324968DBA59B3EB8310F619AEF2388063E8E313C1AF35F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774198871, "uuid": "35cd8798-35ec-41ed-b96c-523deb8e5619", "value": "ab37e991c0540b1618201ea62648c6f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774198871, "uuid": "53f5e8fa-52b3-42b0-be9c-5d544e54b6f0", "value": "12288:XSxmh38dqfvS3ZVPXnhjrsySp5xTqVBFbF8Z4ad+xD2hho99Cm5/uWTGrzo/Oisk:iIQQS3ZlXdlQZswgjuWFGdI2lmaZgCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774198871, "uuid": "06f32af8-a6cb-4dce-a72b-b34898ef5bfa", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774198871, "uuid": "1cc05ae5-115c-44cf-ace5-9ae3ad842982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774198871, "uuid": "dc4deb7c-f8be-4768-8900-a7dec763bf3a", "value": "\u67ec\u57d4\u5be8\u8b66\u65b9\u901a\u544a\u5373\u5c06\u5bf9\u4ee5\u4e0b\u56ed\u533a\u5b9e\u65bd\u6e05\u527f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15bcbf9-2605-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774194185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774194185, "uuid": "07bfcf98-a53a-47ce-95fd-13fef429b546", "comment": "Malware payload", "value": "53dfb7d3ee0a1f120824c6d76981064a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774194185, "uuid": "98ff5ed3-76f5-4f9f-97c0-37d7f7b2c89d", "comment": "Malware payload", "value": "14599c8078954c4255076b866a6e0c302bf9e643875a77e1c4d315f3905d65bc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774194185, "uuid": "9346df3e-d7ee-47ca-b7d7-c340c6973dcd", "comment": "Malware payload", "value": "d0c2213bb7b628921f5304286d769d2df0b8b732", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774194185, "uuid": "ed42c5b2-701d-4a1d-b589-e67e2186bcb4", "comment": "Malware payload", "value": "a58a397bd9e27e7dedd833db1801c9c5467366075652dad9a2ac75f555a7f43f5cdb986e1c93ac41ee2b4785ddb9d221", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774194185, "uuid": "359b2ce1-4cee-471e-95dd-41bb9bdb7a37", "value": "T1EC414C4E4F46D0E1628024FC674F3986B88715FF92158104F79E7B8BAFB4711E2889DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774194185, "uuid": "c1f9dea2-ef8b-4061-9e2e-81cd2ab978ba", "value": "48:aFQBvN2ufHMzQKFGXx3wSTEYLHvHpO8OSI4QiY2Xx30XWB:w2vN2ufM+EXZWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774194185, "uuid": "bbe89b03-cdce-40a8-8157-4a3f93813e7e", "value": 1971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774194185, "uuid": "5d9a299e-ed03-4d9e-8dbe-7c67811be1cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774194185, "uuid": "ba62a549-7bd0-41a0-8143-a3a4fd24c576", "value": "cccc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe0d170-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1774160735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160735, "uuid": "0e710230-e59a-47f2-90ed-af8c0a7aa3d2", "comment": "Malware payload (Blackmoon)", "value": "5df4222e6d7ba4e28e3c30f082f96140", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160735, "uuid": "756324e1-bb78-426e-920e-4665657e38e8", "comment": "Malware payload (Blackmoon)", "value": "1cf48e24ec0befdc5600daf6362a66ae28dfd42e48262680fd296ae9c4c377b3", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160735, "uuid": "9c6e3e71-2798-4ec1-82eb-60a1f1a36f7c", "comment": "Malware payload (Blackmoon)", "value": "c183df4c6eddf014d99fdf8425d4fbe6a1306df3", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160735, "uuid": "ace5570b-c05b-457f-9b8f-a8288855192e", "comment": "Malware payload (Blackmoon)", "value": "09054323b9e263ff3f95b2e816cc95816e924418fea3f99e453f7d52f2e16c3cf9691c652ea125273f2ed302554d39bb", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160735, "uuid": "7276d6fb-1357-45ef-b210-62e5c333fd6c", "value": "T16FA4A6B21F3DE5B7E6B0F47056A91164288EB67799C919F050E223880B79CC1D9C2DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160735, "uuid": "33afd4f5-a131-4357-956e-ae9067c3056f", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160735, "uuid": "5b1b5e5e-3ec0-4bc5-8bf5-bae68c35684e", "value": "6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3hW:q7Tc2NYHUrAwfMp3CDxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160735, "uuid": "6edfe17a-efcb-4a52-abb7-05e6bacf64c8", "value": 469904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160735, "uuid": "5e5d213c-ef7c-4812-b069-694492a61686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160735, "uuid": "801cc2b5-aa98-40d2-9839-d3277a4fbbad", "value": "virussign.com_5df4222e6d7ba4e28e3c30f082f96140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0caaf5f-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774161032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161032, "uuid": "2bd9da77-a7b0-4bb7-ae2a-ddc1cf52d05e", "comment": "Malware payload", "value": "d5eb4461086c7b63055a66067832df60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161032, "uuid": "d6ce53e4-c964-4ab6-b6f6-1c89bb2bb0aa", "comment": "Malware payload", "value": "1dc8f8908997ab9e3984da6e8386ffc290f69107f9abf34c327a268cffd5b72f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161032, "uuid": "a7f16563-66d6-4f10-baa8-cc0b0141b031", "comment": "Malware payload", "value": "a6072a919b6f55b1ec26afb77345e67a3efd3690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161032, "uuid": "5fb2714d-1226-436d-8e22-bdf0d08836c8", "comment": "Malware payload", "value": "5bad077ebdadd09d1c6d08f7794f9ea43c4ceb84f5dd93aa61e681db352082c5faab06ecb7de76e41ee2b5df6259a610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161032, "uuid": "72dcb0ac-5f26-4915-9008-3572412a6a38", "value": "T1EA84E12DDB286A7AF44305B579103A973C924D381193CF86EB45998EB901DA3F2F532F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161032, "uuid": "3651f776-7f60-4c28-9e85-6d52a1a4af93", "value": "6144:zJFzjKA8e+966JhHQpCV9oSHz5FGN+icnqViQ5xLDXher32tH0HmQzoiKVW:zJFKZJJQpCrBKhcrGxUr32tH0GIqVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161032, "uuid": "1cfa4cc0-5a47-4f36-97e4-e73e1928ff2b", "value": 382133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161032, "uuid": "bae35fbe-dd99-4e90-a24a-61743575ce07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161032, "uuid": "0a6471f3-e101-408c-aa74-56c1f2b53080", "value": "virussign.com_d5eb4461086c7b63055a66067832df60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34ba087-2590-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774143910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774143910, "uuid": "fbee29ad-e3e6-4ec4-869c-ab6c5e78bff0", "comment": "Malware payload (RemcosRAT)", "value": "af89536a78180b150a5a7961d4095b61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774143910, "uuid": "8179f5aa-6a05-4397-b94a-3f944ea37381", "comment": "Malware payload (RemcosRAT)", "value": "1e3d5fe030122186af6224340deb2440165cf36a932b59ef03d8fc2ca57495b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774143910, "uuid": "93368722-e0cf-439e-adad-e2ffab996c57", "comment": "Malware payload (RemcosRAT)", "value": "4e8fb3f00f23a019340ab6e11356b228d820b793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774143910, "uuid": "2f6f5875-0e2c-4593-a726-6660e34443c4", "comment": "Malware payload (RemcosRAT)", "value": "4f7bb9121bdc3ea205d1ef9896d132a189acd41b7b79aa35dee25f812e550ee8e204d9a31bae68606a054642cd61f2fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774143910, "uuid": "18d94b1f-cf1e-48bd-b025-0190d16a07bf", "value": "T1D2B4AE01B6D2C1B2D57654300D26E775DEBCBD212836997BB3DA0D57FD70080AB2ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774143910, "uuid": "75146c28-9f65-4152-8c86-01dd51f4a510", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774143910, "uuid": "68cc88cf-e830-46e8-803e-5322f5bf4597", "value": "12288:LvVTj8Zv1VG/V+vuwrBazq6vO6iTt+sPZKw:r9ktVqV2Gq6vO6cttZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774143910, "uuid": "a4982157-14c9-4120-b91b-db641342d9a4", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774143910, "uuid": "7e8011e6-cfcc-40d3-bafe-f3135b24d3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774143910, "uuid": "f1fa145d-148d-41d9-90cc-2c84195dc9fd", "value": "AF89536A78180B150A5A7961D4095B61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41698a89-260f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774198238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774198238, "uuid": "325061c4-7f27-4abc-947f-48b4b07db69d", "comment": "Malware payload", "value": "e8fa2e8cab65f11d9b18b772ba312351", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774198238, "uuid": "d8364e0b-dbeb-4ca6-8db4-e49c07743671", "comment": "Malware payload", "value": "201cdcdf12ce24224cb1c7607220d99598cb1ebbde2ec4d2c2f2cf8783cab799", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774198238, "uuid": "e81ae00a-c7c2-4d3a-9637-274a62edf0fe", "comment": "Malware payload", "value": "89d3e1294be65deb17f814a8d1113f2ce90011ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774198238, "uuid": "6d34097f-d2ee-4537-b7c4-e9609af7a5d0", "comment": "Malware payload", "value": "0629f875b216ec0a2f9c23d3fc9fbfcd9b9cbfbbfefe511dba774c02b0e395d729e9a03157e14f78980d6d38f18c34a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774198238, "uuid": "908e9e73-0f00-43c8-808d-10ca9b7fa9b0", "value": "T14107CE23F6156996C9D6A235F1E3279133201E4403939279175FF02AFDF26CECA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774198238, "uuid": "469a60ef-0847-41a0-baac-23ef4e1e17c5", "value": "393216:RWBAwXgbSIsQXXEpZKhqu+4QTXCeglE47NeD8vSO43o:NwIRsQX0pZKhqu+4yXdgpeDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774198238, "uuid": "fce9b9e2-1d51-4b25-8d79-dea96e93fc5f", "value": 17786440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774198238, "uuid": "83593951-16a6-4a8e-8f37-276d404639e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774198238, "uuid": "17e8673f-661d-4839-a896-6934b3f094a3", "value": "malware-1774198230372-615827870.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a52afd-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Kolab)", "timestamp": 1774160909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160909, "uuid": "b69a073c-3de5-48fc-8597-a13de96458f3", "comment": "Malware payload (Worm.Kolab)", "value": "af064499da08c11936e3c1d66acae650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Kolab", "colour": "#9DB3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160909, "uuid": "84861de1-0bfc-4469-a7c0-ebb04edaca78", "comment": "Malware payload (Worm.Kolab)", "value": "227e8678d85bff501bb909e0d61ee25554bf99c94e47c0194da53e7c246687f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Kolab", "colour": "#9DB3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160909, "uuid": "9606ee7d-f0ca-4c2a-987c-e34e0a2f6811", "comment": "Malware payload (Worm.Kolab)", "value": "8cb2db16546062d3b262a61c5a9c1f025662f19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Kolab", "colour": "#9DB3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160909, "uuid": "b3b76af8-457b-4d43-9a25-d5e6ebfe1416", "comment": "Malware payload (Worm.Kolab)", "value": "2dbe5976c457f8205d1a6204849a1ac56ab8d8c9f83bc19595a19b00cb9f900b1a97ce04f2160415836b0c9f1ea596a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Kolab", "colour": "#9DB3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160909, "uuid": "d193150c-f847-4db7-a356-e5ede77b7338", "value": "T1BE35EA01BF98C4D0D12486330FE5CF867629BDA79E62172B3284731FDDFE681EA16694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160909, "uuid": "77da8f6f-0a43-4e19-9dd7-c1be7ab191cf", "value": "6ec9f2d9d5104bf70debbf6dac2385ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160909, "uuid": "b830d827-4c21-4834-9562-d4820ed61be2", "value": "6144:qdgjsb9s01RfGS8RZoZibHVupKoQSi11YKd0oAyOBNMZ:FX+E7aiJupI1YKdVtwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160909, "uuid": "bd6b7157-1a24-4c09-8e45-d3324d937785", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160909, "uuid": "1d9b0ad0-76cc-429d-9522-2a3e901a29ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160909, "uuid": "cdb89671-5977-49f5-b55d-e8a661f3ddba", "value": "virussign.com_af064499da08c11936e3c1d66acae650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ce33a0-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208985, "uuid": "8165f379-52d5-47b6-82a6-7c504f19f123", "comment": "Malware payload (Mirai)", "value": "eae1716b7601184dc0a84ab7041da645", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208985, "uuid": "295138ed-0da3-40ce-b8b2-13a49d98a788", "comment": "Malware payload (Mirai)", "value": "24517ddb231e26591cc6225c747f8a422e53546d16410c82d4919728849e4668", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208985, "uuid": "8901d394-c683-4ef4-a6ec-5a7ae5715b04", "comment": "Malware payload (Mirai)", "value": "b94321098e76e6cdd18e3e895d3bbce6ebe627b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208985, "uuid": "2db86c27-dcd4-4b69-8bff-72194dd9ccf1", "comment": "Malware payload (Mirai)", "value": "ddefe31e2c92f6c9a2198a5564efa842109cae1f964ffd6df29cba259adb15bd91fbfc7227bd691de09d3c12aa098003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208985, "uuid": "55361dce-c5ca-4fb0-a156-087e756ba164", "value": "T1A0A34C0277080E47E5935EF0393F27E193EED99121F4F688261FEB469176E32158AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208985, "uuid": "811f6748-3284-43f0-af90-b096ad4bacbe", "value": "1536:aFZ1mI2jRMiPt+7Xe2U7pW4Z+raw5zhS6JeozJbH3GMW60x00XIX1/DXtQ+Q:hIlu9Ue+r3S16B46o0fthQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208985, "uuid": "65d6daf1-6e21-4e1d-b335-450c73520f23", "value": 99720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208985, "uuid": "9b70fc32-fefc-4117-b493-54d643afdaa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208985, "uuid": "aa0e759d-b506-4a55-824a-6542ec1de809", "value": "tux.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b63fdd6-25a2-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774151494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774151494, "uuid": "63a61d74-b2a1-4e4d-986f-4ddce1eff955", "comment": "Malware payload (ConnectWise)", "value": "1078164d64cc5ce4a1500bbb1d13a0b9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774151494, "uuid": "0dfddfbc-0343-42a3-8f9d-136d8c2b7023", "comment": "Malware payload (ConnectWise)", "value": "262de07dbddabb37257670e9b5cdf0a796caa7e2c52949f8d8c089ae6400ead6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774151494, "uuid": "f612b48e-1cb9-4aad-9ba7-c440b58d58af", "comment": "Malware payload (ConnectWise)", "value": "20d517502ff7bc1cbcdd2917a86a5c737a52fb36", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774151494, "uuid": "eade1340-ffcb-4b6b-acf1-a14f47b861cb", "comment": "Malware payload (ConnectWise)", "value": "f561d0a0047b6e763cbaabfe43ea1a173d3d9d5a530257e394ff3ca2cb57d3230cae6a6f02df0f4173755a8fcffbbdc0", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774151494, "uuid": "4cbfbc9f-f282-4d55-8922-e4538fafe576", "value": "T1DDC60111EBA8917BF0A11675B836606394267C337922CD2A12D7781F1B73FB09D72E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774151494, "uuid": "fdbec9dc-4259-4fb6-bc3b-cdb935c16c94", "value": "196608:FHxcp9ym3nltDUJVTHxcp9ym37Hxcp9ym3iHxcp9ym38Hxcp9ym3pHxcp9ym3:3GplpQGpFGpwGpaGp7Gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774151494, "uuid": "75b1b400-52b1-40a8-84d0-2a284e9c9429", "value": 12288000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774151494, "uuid": "f3e39db2-e475-4d66-a579-345303458fc2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774151494, "uuid": "3da3c2b9-990e-426e-b44a-bd6d517db491", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68e3d1a-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161096, "uuid": "0b78c037-fc8b-4d22-8417-60aea2954299", "comment": "Malware payload (Berbew)", "value": "e9ef4fa7f6966440d0fe731cfdaaf550", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161096, "uuid": "714ef34b-8049-4d9d-ba08-2e11097c4afd", "comment": "Malware payload (Berbew)", "value": "266f07bcf30b2641883965d4fcc5d26e8d38c88addc31d19d86e6659d791d447", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161096, "uuid": "f4303f12-b8ad-4c37-9300-c871751a7b39", "comment": "Malware payload (Berbew)", "value": "da78ca55e58d23ddbb17d0676544d5648ea9fa40", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161096, "uuid": "6e0002bd-14f1-40df-9380-094231cba08f", "comment": "Malware payload (Berbew)", "value": "6420523cff5924a6457ed0824c8176eb8393f36d3ae9c66980b921de1edbe7de03d85a1901e66151e9c041fe69591d50", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161096, "uuid": "9a582b74-d7f5-4cf9-92a1-472482e1b7f5", "value": "T1E1645A6220349FBEDC9C077C94EB535BE2EC29C40A6568471B71F28F69756F1C8E86C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161096, "uuid": "33b3ebb8-1f20-46c5-9555-ada5b1d4b1da", "value": "62ec3dce1eba1b68f6a4511bb09f8c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161096, "uuid": "08a1deb1-4c5c-4c05-9d1c-dd87492b0d58", "value": "6144:40D2jvosK6mUzW0jAWRD2jvosK6mUzWJEmQ/xvAORykVbn9Xa:Xx67fLx67+dQ/XR5bn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161096, "uuid": "d379c0c7-7f8d-4b0c-a5be-00bf6f7924a0", "value": 307212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161096, "uuid": "e45cceab-2d81-4c33-a104-389a5922ce58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161096, "uuid": "12129223-65bb-42b5-bb2f-409aaf7e77c0", "value": "virussign.com_e9ef4fa7f6966440d0fe731cfdaaf550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad400df-2600-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774191839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191839, "uuid": "e0e5bcc4-d35a-4c8d-9f13-f531835397a1", "comment": "Malware payload", "value": "2e48b519b857bdc7f1cc6f348c32247e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191839, "uuid": "502e386a-cc17-4421-a565-547e4b40cca4", "comment": "Malware payload", "value": "27c8036ff261d0c20acf580221f8fd87a1cef9cf8a6158a3a54a9ced71893240", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191839, "uuid": "43974030-e933-42aa-b0d9-4601897c70df", "comment": "Malware payload", "value": "fec4e541e086dd605aa48922de6b2d96c1490e90", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191839, "uuid": "0beb9404-b14a-4cf4-b7ac-dbffbfa00298", "comment": "Malware payload", "value": "11ddadc57da0230668bb1b25bad969b273f25bae336740a08bee83cdb4efe6d88a0412b58fe027ae5adcb0984169b132", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191839, "uuid": "9e073cbc-0ea6-4c24-9080-0a775d244b24", "value": "T13C925DB512496C79FBD1CE39AF3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191839, "uuid": "9fb5a648-b74e-4d4e-b38f-75fa5113f688", "value": "384:F5FcuQpWx+BL0SWL0gtzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:F5F8i+BL0SI0qzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774191839, "uuid": "ad1ddc21-8414-4401-96f2-da7eca867981", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774191839, "uuid": "15f4a9b5-0a16-4b2c-a078-49a982f2b31d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191839, "uuid": "dc60a12d-5aa3-4e4e-8323-c0fb725dde0e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7e5796-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774161104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161104, "uuid": "5cec6083-99b2-44d5-939e-bac12996b366", "comment": "Malware payload (KawaiiUnicorn)", "value": "ec851635ce58008da86f9a497f53ce50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161104, "uuid": "b8d10344-e41a-4aff-9296-2998a8712ba3", "comment": "Malware payload (KawaiiUnicorn)", "value": "28e6aa7c692ec47e56f15e1e356f206c2c02541d51c34c3bc219d4732fa9162a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161104, "uuid": "2f1d4823-e845-4303-b699-f139d7f4d113", "comment": "Malware payload (KawaiiUnicorn)", "value": "04bf0df62abd09a0a4ce3e0b2b79e00e049d2883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161104, "uuid": "9a62e176-9e43-413e-885e-55fb104f48be", "comment": "Malware payload (KawaiiUnicorn)", "value": "bd1ec88ad1438b01c14e21eb7237886717352682db5beca94052ea9641d89d1abbf1c76c66aa617df589ff9f16737106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161104, "uuid": "9ecb7f40-b7be-4c8f-a85c-944a310b5891", "value": "T1D5A4A5929C64AF46FE16453423956EBA404E7D2F66E4421C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161104, "uuid": "64f79276-1150-4c81-bc37-0050a148e485", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161104, "uuid": "427b6025-1b04-482c-a772-34880a8defa9", "value": "3072:n1ZMogJl0h8Ut+jVPz5Fff1CPajWI8wdmHevVowzD6eygIlw5l+:n1moFCUt6P1FffQx8bzDxfIlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161104, "uuid": "58c57f22-e271-44e4-adbb-ead90c090dde", "value": 479241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161104, "uuid": "fa0f236a-2393-4de5-8014-eeb60f0a914b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161104, "uuid": "4659e472-8467-4bcf-bb01-df95b14409ed", "value": "virussign.com_ec851635ce58008da86f9a497f53ce50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c59dbd6-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774160783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160783, "uuid": "ff5a6eb4-f569-4282-afdc-bf954c7364aa", "comment": "Malware payload (Snojan)", "value": "8371fc1541031f8853a7c72b22665090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160783, "uuid": "b107c696-700d-40a5-943f-0041d377b925", "comment": "Malware payload (Snojan)", "value": "2b42508d21c45eca4f626ebfce0f6e7aae40639d3e124512363312399ff614ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160783, "uuid": "6e02a225-8f41-46af-bd82-1ae3931d3cf7", "comment": "Malware payload (Snojan)", "value": "f1a8c5126532743e77c07d8463c9d31b2f2e9b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160783, "uuid": "5dbb30af-7e6b-4652-99e8-6454c9453789", "comment": "Malware payload (Snojan)", "value": "63b143d19b6433352790eac0e350068fe7f1e95ee4bd63b021aee102a988d1e933009422396c023815554e8af61dfeef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160783, "uuid": "42b0779c-4db0-487e-b3a8-d6cb1b9941d2", "value": "T15F345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160783, "uuid": "01db4794-9b3d-48f4-ba55-e0152f4f6c43", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160783, "uuid": "27aef6af-751f-4a32-98b7-df50f71027b0", "value": "3072:zJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/i/FnncroP9:1wDeM7iNEkgiOb31k1ECEJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160783, "uuid": "d03bf8a1-0a81-4ac1-b6ca-439fb8c0d23d", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160783, "uuid": "518c1b70-16e6-409a-a203-2d89ec17fe06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160783, "uuid": "df5c997e-b6d3-49f7-80a4-655bf50140cc", "value": "virussign.com_8371fc1541031f8853a7c72b22665090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ba675d-2615-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1774200937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774200937, "uuid": "142ef341-8091-4966-b181-3c6f6f76ac0a", "comment": "Malware payload (DCRat)", "value": "b754314fd95fb4c47486e138414bffd1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774200937, "uuid": "603aa7a5-19bc-4441-bf3a-f17c02b1f221", "comment": "Malware payload (DCRat)", "value": "2e1d907e37b117a8adc91bb4d2959a202ff5125337f5191192253fa96ba0edda", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774200937, "uuid": "4d7254e5-8df2-4ccd-a4f0-658fee0f0944", "comment": "Malware payload (DCRat)", "value": "386197b1d30c823cd48ebd0abfded8d0a116da4a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774200937, "uuid": "23efd582-8869-4981-ac13-b2ec406a28c6", "comment": "Malware payload (DCRat)", "value": "42fff0e9947d3ba7021aea9be252a4b03c16a0b7344cac8655f4c2cb0a8b71d903513daa360746615746b3aa2086aa0a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774200937, "uuid": "4f5f6733-8a28-4289-af42-869de79c243b", "value": "T1B385AE1665934F32C3B457318967023D62A1DB663621FB1F3A1F20D2B957BF08B722A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774200937, "uuid": "c84f30a1-5d78-4343-93b8-02eb3c0fd144", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774200937, "uuid": "bcd7d4d8-d42e-43d1-8b39-dc406b382a6e", "value": "24576:tnLGv3QQr/c9NIPr/ACjS2zjl8T3+XAgReMpOnVHNXP4hZJ7GhpgRj0EbuTP0wY:t4MAYEzjM8A0+V5whZJ7ypqry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774200937, "uuid": "10010656-d4ee-46a1-b339-3fcdba44dc57", "value": 1824256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774200937, "uuid": "df2b560e-56c3-4830-b9a0-441aed1d2e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774200937, "uuid": "ffe0f223-d84e-4477-850c-88a99ee164f4", "value": "B754314FD95FB4C47486E138414BFFD1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f9a791-25f1-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774185307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185307, "uuid": "9d20ac9d-674a-49ca-bc05-bd2f30847220", "comment": "Malware payload (FlyAgent)", "value": "a5b93bb9a551cedc27564082a5ee9aea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185307, "uuid": "47716f37-dcf2-4ec3-ae1a-65418395ac18", "comment": "Malware payload (FlyAgent)", "value": "2ef4ba00db739a5408fd430b433298efee75db257eb0889a6a90fade159aa90b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185307, "uuid": "b2063c7a-566e-46b9-8ff0-3c7d6a412387", "comment": "Malware payload (FlyAgent)", "value": "e05e1e2b7b025eee500146bf884b420818d6d24e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185307, "uuid": "67b95c56-1da5-43f3-8123-914ef7f78ee8", "comment": "Malware payload (FlyAgent)", "value": "214870f2964ff4d1623711f88079ab4f229078b2baa26842958aaccdd9ca42fb986009e1ea270a9cfd5e8b2632c68cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185307, "uuid": "98682606-891f-4170-8e4a-690901873d69", "value": "T149658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185307, "uuid": "03493d3d-fe6a-489a-902d-b8812b5bf9a7", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185307, "uuid": "33b3a1cb-ae66-4709-bc71-877907150431", "value": "24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QE:GcallSllG4ZM7QzMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185307, "uuid": "0bfb2df2-a544-4a25-926c-f4b3190671a0", "value": 1437848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185307, "uuid": "834444fe-8a70-4463-83a5-626291082069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185307, "uuid": "b8fd025f-6f93-4dd3-9111-fbd03aa3d561", "value": "2ef4ba00db739a54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0fc749-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1774160680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160680, "uuid": "457792ca-06e6-4a47-9a4c-1c5e22b00d99", "comment": "Malware payload (Expiro)", "value": "36bbad80749663dfaaa18a10fd6b4890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160680, "uuid": "79a4b4d5-95ab-45d9-8ee6-432deb8b1be3", "comment": "Malware payload (Expiro)", "value": "2efbfae61340f3157b6a5dc0ae0b603b2e46d0aa9de8d9e576158ce144d719a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160680, "uuid": "d5de9c79-9c3f-499b-9259-0d1c2363e56e", "comment": "Malware payload (Expiro)", "value": "3dc611e7c9757e12df89d7ae8f9d46e55d09dbf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160680, "uuid": "a554f2ad-49e2-4116-8300-71686f4546db", "comment": "Malware payload (Expiro)", "value": "9db172189306de3d6d5e3a6281ccd9bfca6d5ac2405fbdac278147aae77c31466a2f03b5c652eda01a1ec3cdc03c58b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160680, "uuid": "9e157214-c4f6-4f6a-bdb6-2c487a60a6e6", "value": "T19A369D46B36610F9C03E8279C5978716F7B4782807628BEB4AD086695F337E02E3F756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160680, "uuid": "de5b655f-0bd2-4b15-9d3e-afa8dadb7f15", "value": "6f20c149a88d6cd7ee624fa7c612c3ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160680, "uuid": "9c1b4792-601b-4436-ad0c-75235ab59fa8", "value": "98304:DA7kOTMnoGn//Y+vF+ohiKvReYDdFF86rg77XCSxO:DA7kQqoUBzRlDdTPgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160680, "uuid": "5d04e6cd-59e7-4133-8ce8-d143c0ea3a70", "value": 4972032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160680, "uuid": "230436bb-9383-4299-a168-a10b6cc51532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160680, "uuid": "47ecbdc8-bb16-42fd-bf5e-f40d662fbca7", "value": "virussign.com_36bbad80749663dfaaa18a10fd6b4890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37faaa4-2599-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774147776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147776, "uuid": "8aaf3fd1-36b0-46f0-beb9-989651573473", "comment": "Malware payload", "value": "7b9dda0f92be1abdbcada36d3585a233", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147776, "uuid": "b8a0132c-f3b0-4be8-8d8f-74c6dec6873c", "comment": "Malware payload", "value": "2f82118f9d3ebd32b43cba844c33772900b5f7ae2a3623c480649e76a29f96e1", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147776, "uuid": "2a776ce4-2d25-4b00-8969-c7a52a850b24", "comment": "Malware payload", "value": "bfd6759c7eaa0bd50f7ef19537df4361bf52fb4f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147776, "uuid": "da467f0a-6bae-411a-9d2e-b006a19b20a3", "comment": "Malware payload", "value": "4ae66bb08f83dc43b729b1ea803410f3596432b0a1d2883a5358b891205e19d7260a22dcc5089569a2eb98705877a4a5", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147776, "uuid": "d11640d5-ce51-4de8-b5a2-d108b5e36ea8", "value": "T15BB3DCCF4A4E44FD8A07342D650F2C07C7AB16132B1CC690BADFA9653F22D71A1B69C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147776, "uuid": "2ebc616f-79ba-4dc3-99e9-a68b2f86db36", "value": "1536:EBdgK1Gv/n1SgUn2pkN4obe7OSplnfz/eVEu:EBdgKmnzFplnfz/eVEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774147776, "uuid": "0b0c2e8f-0e9c-403d-b0e5-0bb95ab7eb97", "value": 115424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774147776, "uuid": "d4f79f4a-2445-4de4-8f0b-f5a3f6e0f8ff", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147776, "uuid": "426d4eff-c23a-4fd3-8fa2-b5bbe335d5b7", "value": "Germany_Invoice_Temp_292.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec338d46-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161159, "uuid": "f0d4ef82-68ef-4f6d-bb68-c4692c08df04", "comment": "Malware payload (Berbew)", "value": "fd972b5ff79a665db01e119bcc9a9170", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161159, "uuid": "aba54669-6274-4a17-898a-dd8d9b5c3022", "comment": "Malware payload (Berbew)", "value": "30bfc49b006b6c9f3cd306347595e09cc1f91c58f122876706ad226ae83d542b", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161159, "uuid": "d0c47372-fbca-4e6f-bf12-6efe877442a3", "comment": "Malware payload (Berbew)", "value": "5976369631e2aaf03c8d3e7cdb39bf8081e76907", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161159, "uuid": "cb9e319b-6a51-48fe-95e3-cdb9907baf08", "comment": "Malware payload (Berbew)", "value": "e68eb39aa802c2b3472d1f3a6ea902fc821d1aade261aa0bcadde7a4e1450dfe860056bdc4ff74bd8e6e408aebbe4468", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161159, "uuid": "0d4465cc-dfc0-490b-8945-424b2edd237f", "value": "T1B834E143447A4F9ED929163C44710B1DE67680FD7E7BD2BE9384C371BEE20A1898CE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161159, "uuid": "6d50bcd6-e4d6-4040-b39e-4bb5c08bb7dc", "value": "62ec3dce1eba1b68f6a4511bb09f8c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161159, "uuid": "f5157fbc-4843-401b-9dd0-da7168bf4d9c", "value": "3072:HUtdN6a8GzjhG/PpKz8lHXtlU2Nhluy78nwTxyIvXQWBaolfC4VJ62QG:Hk8QjhG3pKzwdlU2zlNgwTnAWtlhjQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161159, "uuid": "901947a1-6c4b-47be-8b1c-f5aef8dc492d", "value": 249388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161159, "uuid": "45903552-115f-4d14-8484-82826153fd94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161159, "uuid": "b0381327-50ae-4e6c-abbe-a3a7c642a243", "value": "virussign.com_fd972b5ff79a665db01e119bcc9a9170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5ae3aa-25fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774190799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774190799, "uuid": "da61099e-31c9-470a-8e9d-9453fd9ca695", "comment": "Malware payload", "value": "24793179062aa93e2aa93419c516594e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774190799, "uuid": "896b318d-a9c6-4449-88ab-eab5bcf2eafb", "comment": "Malware payload", "value": "315c0493129873c41597b3d171501d4cc5dbea2eb9acd75908b47008f87603d8", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774190799, "uuid": "22d5223b-742b-4dfc-9cd0-12f1127da4f5", "comment": "Malware payload", "value": "6a0c12290649f18c2d3f9f3ec65d5fa90f699324", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774190799, "uuid": "968c3cec-0093-4120-9363-afb050719478", "comment": "Malware payload", "value": "3760447ed5c96a759b53a012578e8d93da17ad8373b86ffbc0c8b95b3bb2abb92de90c50e82573f7dfdfb24d67c1c2c5", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774190799, "uuid": "6d951bfc-71ec-4d50-99b7-902c9ecbb274", "value": "T196B3108849CE88699F5F3078451F5E078BCC9223036DD9D07ADEEE553F229BD71AA2D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774190799, "uuid": "5345cf30-450b-417b-9a78-b7b5a2ac9e98", "value": "1536:IXoMk9tLO5XnxefAvzJyH1n49zLBFzejuXYhtNA5l8rkq3cx:1OhnxefAv+49PTzGuXYhtN0l8cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774190799, "uuid": "0ebe0a5a-a48c-4d00-a754-a06ba4ed226d", "value": 114080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774190799, "uuid": "3d5129c0-7921-4fc8-a63c-f1f3133cc562", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774190799, "uuid": "e89eac27-4af5-4f44-9775-9bf3c51f07bc", "value": "Y_Photos_Canada_9177.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5b20ca-25c1-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774164786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774164786, "uuid": "c1de7425-bfa0-4080-ab54-fee6ceac918c", "comment": "Malware payload (njrat)", "value": "e0a9ab3ee4df1a261af22eee00450772", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774164786, "uuid": "b4df69aa-170d-409b-9410-f62d8d277ef0", "comment": "Malware payload (njrat)", "value": "324913605c99f61689635c6e58dee8a1f874c25688d73c150ac19f581f9c2028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774164786, "uuid": "16258b1e-8311-4564-a601-903df717ebc1", "comment": "Malware payload (njrat)", "value": "276b45e8dd2ebd62ed8f40ed08c77d3a45532f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774164786, "uuid": "ba1ea24b-28a9-44f1-886f-a29bfc034d36", "comment": "Malware payload (njrat)", "value": "403efa2c2cd1318a98a775f3e6c70f9bb6c5b75d5ba4a6b1abc878cef79a989ee8fa6bca89b83f3b9659438fe2e5d969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774164786, "uuid": "9968e853-524a-4e5e-995f-0686318098d0", "value": "T1FA134C04B7D00626D9FEAFB01DB3A1060671DA07AA13EB5E08E495DA5F77AC0CD117E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774164786, "uuid": "4fe3ec66-dceb-4598-b248-0655a57f0db2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774164786, "uuid": "eb2fe70e-27e3-4365-a339-e44a2f303f6c", "value": "768:GwLU2386fgE+Ahvjom4yKKF0F9xkJ9tOrhqATNC:GoV9b+A58mhFY9xkrtOrlNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774164786, "uuid": "60dd6188-1e8a-492d-8193-607908e43b1e", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774164786, "uuid": "4a55b97f-0713-49c5-9b02-35ecdce6a047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774164786, "uuid": "38693e0c-5dd9-4dbf-a55e-6fb445db3617", "value": "svhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a814a6b6-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1774160615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160615, "uuid": "b87abd1f-b775-44c2-a265-ea9cfaa329fd", "comment": "Malware payload (CobaltStrike)", "value": "01d7d0ca04fe08d5776ac3fc74fe6510", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160615, "uuid": "adb84ca7-b19a-4f92-82cd-2b67e5ee1cb0", "comment": "Malware payload (CobaltStrike)", "value": "327629c21782f90f4bd5f7c0779d05e9dbe87244dbf6bbef6703293700f2a620", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160615, "uuid": "5019d854-57d8-4187-bf5a-c882b0d86afc", "comment": "Malware payload (CobaltStrike)", "value": "40b890c3abd2873d4c894f5b6640c739b5421fcd", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160615, "uuid": "658d6a38-77a6-467a-bc5a-4c4891e42675", "comment": "Malware payload (CobaltStrike)", "value": "0982c7620c30efaeb8e297cc046cf8d72c69dbf3e4f9445a6d979d47619d57086b755dd908321a1d3a048e79db94074f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160615, "uuid": "46510771-3e89-4314-9907-5344c3a2d0d2", "value": "T1E674DFA13585D037D4570479224FC77E5BBCBDF406B1A587BB84196AAE32393EB2A303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160615, "uuid": "90b39bc4-d725-4f3d-9b2d-420a1fffbf3e", "value": "f2e0b7b9a08bd8dcaf133d9278ecdb47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160615, "uuid": "82f3bc4e-9461-45d5-b5e7-d8f661ab9389", "value": "6144:PjdFKdoSxvixTxUAHh/w2GWziZms1f4wYd20OmcfA:jhGvixUAOv113YdlO3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160615, "uuid": "beee4610-f7b5-4f96-ae4e-c67b6ec387d5", "value": 347113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160615, "uuid": "21c3a2fb-5c6b-4218-bc77-1c2d63aa3999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160615, "uuid": "9c42a1fb-789b-4802-bd7d-2bfb43cbd0d8", "value": "virussign.com_01d7d0ca04fe08d5776ac3fc74fe6510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7585ddc4-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160530, "uuid": "002f5651-3358-45e3-8a93-3854f9e5ac3d", "comment": "Malware payload", "value": "6e6fcfb0e9d4f95add875b894ca164c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160530, "uuid": "7f38d12d-6243-4fac-b517-e98ba944805e", "comment": "Malware payload", "value": "337ee64e0817a7740dc82483257dd2021a4190a1337d35a84009173678d33ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160530, "uuid": "3306e9be-5905-4510-bbef-978285b86c2a", "comment": "Malware payload", "value": "18f251a4606b284d0c55fd5ddf217bf39df978a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160530, "uuid": "c3017639-4048-40f0-85d9-4c4f8ae62fb4", "comment": "Malware payload", "value": "fc1df629854bb1b8e586dd98ef541b0879ae82c37149619e91bbc51cac2be0d5a1680f16b4bf293c814da45e8522725a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160530, "uuid": "01710e31-51bc-4da9-9237-4bfc2c0fff2a", "value": "T1879459273388A901D444423DDCEBDA7D666AFDD0AF5500FBB6E13FEF2B729526029211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160530, "uuid": "e4982250-7436-40f1-8b17-570eecd99ddd", "value": "10e2bbfe892cc5d66c55a46a1a0ab0bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160530, "uuid": "b772e87f-2849-4ff7-9891-6b358f5aaa5f", "value": "3072:Xn6gH+oU7pfJCmokSBmXtXwKLzZZwljHtnkUrGpDXb17ftv7YjUJnlXtLKWQ9NtW:XndO1hY1IhPiLFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160530, "uuid": "6a1152a6-fc4c-493d-9c6f-3285f7b71ff7", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160530, "uuid": "d6812b6b-f413-4cba-9d77-5b21000a168f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160530, "uuid": "81622de1-e2b3-4962-96f5-34bbbda41f13", "value": "HDSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01db3804-25e4-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774179663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179663, "uuid": "422180b5-2805-47de-9d68-2660ef58214b", "comment": "Malware payload (SalatStealer)", "value": "f21e92a85b929ce45a35ecc73520cdd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179663, "uuid": "815f5b2a-9781-4ee6-ae0a-b54c640e0045", "comment": "Malware payload (SalatStealer)", "value": "346e75418d57e1848064614e3922813955ca10e7d015ba3679f9036ac31fa1bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179663, "uuid": "60a019d3-7f11-4cda-b4b8-fba93053eeb0", "comment": "Malware payload (SalatStealer)", "value": "506e8d6ca68cd6708a6c14993de2b673efff26ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179663, "uuid": "1a74bcaf-f423-40a8-ab00-c871d46ecdc1", "comment": "Malware payload (SalatStealer)", "value": "608567151235552fc581aab3e87e0434dbc40ab3cf1eba916f9964725a5fb2fe2218a7bd9e3d3a01b195fb430e18fcfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179663, "uuid": "67fa58f0-e4b1-4379-8264-79ed10a16548", "value": "T11AD65B11FA8B55F2F903583141ABB23F23316D048B28DB9BEB547E6AFC77691187A704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179663, "uuid": "e89f17f4-50e5-4b60-a949-0f53770b0097", "value": "98304:qO2EKBqpfBqNg/0t4T9GgJi346G2If8E:HKoOQecGgc3St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774179663, "uuid": "0ab1251f-9fba-4e33-b02c-0827c4d25e04", "value": 12925440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774179663, "uuid": "ce54f9b8-659d-44b3-8264-55dfabaa56d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179663, "uuid": "167761fb-7f9f-468e-aab1-cb34fa8ec9ad", "value": "x346e75418d57e184806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e264e6-2596-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774146203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774146203, "uuid": "0a64717d-5ac7-4a16-b1b0-5d2c61275808", "comment": "Malware payload (QuasarRAT)", "value": "b9ee2ba8a504bbc011a075b753c63b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774146203, "uuid": "a4953554-cc1e-48cf-bc68-5caa7616db72", "comment": "Malware payload (QuasarRAT)", "value": "347f980961243f929464c7c38cc55949b85f4f52afa0083250cb55fc24ace9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774146203, "uuid": "0a32145a-149a-451d-ae4e-a59438b63463", "comment": "Malware payload (QuasarRAT)", "value": "0ddea983e9d3123c40f286cab9fc5130cf1f67c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774146203, "uuid": "6ac6b6a1-3ce4-4ba4-9dc8-a1594df9f864", "comment": "Malware payload (QuasarRAT)", "value": "24024b20d37b55a82766eff510c9363a1d3ac7b5451192357c2e88e5083cf82cec966cbf2bbbf5f5b776107fc322127e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774146203, "uuid": "1b93292e-ac55-4898-8eee-552f100804bf", "value": "T132E55A053BF85E33E56FEAB295B1501757F0F81AB3A3EB0B2181A3B81C97B504D416A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774146203, "uuid": "18f14928-13a1-4aef-b423-4d26f39fe157", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774146203, "uuid": "5760b521-2ccd-480f-87af-97485eee64cd", "value": "49152:zqvR0ZUZLxI4osU6bGltNLbS6i8yFdoxKo/xUuxG7THHB72eh2NT:zqJ0ZUZLu4osU6bGltNLbS6ilaK+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774146203, "uuid": "8c8b4cc7-f0a7-4a91-b151-5a491ec3ef58", "value": 3299328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774146203, "uuid": "7c6c1132-d9d8-4f2f-9e8c-5abe6689614d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774146203, "uuid": "6930801b-ae19-425d-81ea-d2f23fb79fe9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0719144a-25e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774177954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177954, "uuid": "cfea6a20-136d-4e2f-b95a-02127fa5662d", "comment": "Malware payload", "value": "64c0270d90115cbcfa03a45544aa72cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177954, "uuid": "c4e18bd2-d1cd-4ccd-bae3-6ff46cfeae9b", "comment": "Malware payload", "value": "34c578754cb2f08e5d8a5b02f1aeaa5d90ff3b566b9beae3a76ab77efb878194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177954, "uuid": "0db48c3f-31e6-4467-80df-5a63f26f4778", "comment": "Malware payload", "value": "40c6254f3b12731693a414c3eec78f80333de74e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177954, "uuid": "84591ad0-7d73-4ded-a64d-086a563974ab", "comment": "Malware payload", "value": "128b8957a2724ad62585cc749debf363f0daa340ec3965ececf6e229bfb82b21b6268d721fab1681428020da207cc888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177954, "uuid": "5060b692-d7a2-414a-b7ef-d72fd236f908", "value": "T191F7333BE18F6139C0AE12752573D920897F29A164629C236AECF8DCCB250755E3F6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177954, "uuid": "f3818cbd-bcb7-4cff-ae12-a8972074c121", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177954, "uuid": "880a3d16-2cb1-4db5-aa9d-25181ea914f4", "value": "1572864:Gibp32FzeZjKmqyQvJOhcnU3LODgOlh2C5xImt:6FCWm4hG4U3L3OOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774177954, "uuid": "c5f5677d-884c-4227-bcbe-6618d946cd6c", "value": 71704488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774177954, "uuid": "101a246c-1619-4a28-81a7-d509710bb581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177954, "uuid": "deecace8-9117-4d76-9b89-e4fb2e0aae23", "value": "Certificado23947823_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d414fd-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160955, "uuid": "5e86dc8e-25a3-4f20-bbe3-34b5221fc9e8", "comment": "Malware payload (KawaiiUnicorn)", "value": "bdd8429fc9e410edabc4f9a98daf8f60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160955, "uuid": "8e9fe801-b2bb-478a-a883-7a7fa01caf51", "comment": "Malware payload (KawaiiUnicorn)", "value": "361fa581739833c5be6cbaba616610a65e86dc929f2ec853d065dced343604dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160955, "uuid": "d4cc9317-b527-4ccb-9c54-799915fe8838", "comment": "Malware payload (KawaiiUnicorn)", "value": "367c57458e27b5300f2b0bfa63fa5faf75da750a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160955, "uuid": "2154c6ff-d03b-448f-8392-9012c9c74c16", "comment": "Malware payload (KawaiiUnicorn)", "value": "70fac4c2143711e8b0f8f1fc7645a0832a5e7046762489c292f24e24fe57329b2dbb218bb0e08b2a8ad718cef34ff070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160955, "uuid": "041ae877-19aa-4d00-b4d2-e65948460690", "value": "T1B2A494929C64AF45FE16453427956EBA004E7D2F66E4422C785CFA0B337399B30AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160955, "uuid": "f6f23565-7d20-4bdc-8ff9-7f82bffdf00e", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160955, "uuid": "5e4aa267-e56d-47e3-b03b-6cebeed08e80", "value": "3072:uTGBogWajfF32bYS8yojfNr/aXxjYIpptvHeMV+f6HXei4Iv33lV:uT4oi932t8TjfN50aH6Hu3Iv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160955, "uuid": "30c6103c-0392-4910-a4ff-13b57a427078", "value": 479660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160955, "uuid": "a77de38e-4a1e-4b3b-a77d-7145273f96be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160955, "uuid": "054faee5-8f51-49f2-ad55-c578106f1528", "value": "virussign.com_bdd8429fc9e410edabc4f9a98daf8f60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9b5f39-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774161057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161057, "uuid": "58fd3a51-168f-4e12-9077-9805acf22026", "comment": "Malware payload", "value": "de2c3c844d96cb8a53dc057323668e00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161057, "uuid": "1d222d47-1c7f-4653-a896-1bdb47c9f14a", "comment": "Malware payload", "value": "366541c98ffb6508ab780f5ef5a94e40beab86f69ddbad51b632c233426000e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161057, "uuid": "a8620023-e087-476f-b850-dca0e4eaf130", "comment": "Malware payload", "value": "2f8d5db4f73d06f45df88e760fe2824485c477cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161057, "uuid": "50102d20-0c34-4102-ae22-689e12d78e4c", "comment": "Malware payload", "value": "dccf18d9c853284e618cc7880759bb46c26a5a4ae59e7fdcfc7583f2248757de796596a27bc037ea22402f1d5b7e8fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161057, "uuid": "f10d0a59-04d0-4107-8aad-202db47f9f5c", "value": "T11755B313AF5D5146E9620432193A4B656B256C38B4229D0BF381BE5DECB2BC3BDF431B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161057, "uuid": "4009345e-5f8a-4393-bf0a-3c800364716e", "value": "92bd10745f0545d6a57478757d3eb85d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161057, "uuid": "561d8a22-3703-4f8a-b018-3443cbfefb95", "value": "12288:WUFE1rh/+J64yKPzDiZVyiz8ZwRmVT/SoS/tZnt9RvptwhDwsGfFB+khKOSEQwFe:LkYUKUr3pkgSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161057, "uuid": "8602c6c5-c3c1-451a-8465-b2019065472f", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161057, "uuid": "d8f2fe28-63bc-429e-8d79-4537579c409f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161057, "uuid": "3635574f-056b-4b2c-bac2-d02caf74f27a", "value": "virussign.com_de2c3c844d96cb8a53dc057323668e00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c05cda-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Mofksys)", "timestamp": 1774160931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160931, "uuid": "657ab016-2043-48b0-a191-5f9b65d21d0e", "comment": "Malware payload (Worm.Mofksys)", "value": "b38eb0c41a03889bb577584afdb976e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160931, "uuid": "a47ad622-45c9-43bb-86a5-351c56bae700", "comment": "Malware payload (Worm.Mofksys)", "value": "366c5aaafaeca8598ee761b5562fadb00a72d257fcb482b179a7f0b7f40b1705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160931, "uuid": "56f1ea3f-21eb-429f-81dc-be674091af54", "comment": "Malware payload (Worm.Mofksys)", "value": "bfbbd72d75e412b4f485ee2426c2fc06443616f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160931, "uuid": "90b15f50-4c77-4e0e-b20d-d6dd389ec76d", "comment": "Malware payload (Worm.Mofksys)", "value": "8b0cb57fe6b44ef5c7b1475cdcb1187bcdfedc3efde4a411a4f9668067bbf9705bdda1ba7ae43cfbe0bb892e97777e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Mofksys", "colour": "#7B4673", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160931, "uuid": "5d791c0c-539f-4417-90bd-9faf081eaa7a", "value": "T1C9F4E0813B1C89D9ED5842F5E7B23E0A12769C7906879B1D2D2EFC349B1B1BD09B2D1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160931, "uuid": "cc22b329-33ea-4716-9d8c-0f0f9c11ccdc", "value": "5962c6b29ed5e50f362bf7495f752822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160931, "uuid": "ed78303b-f23f-4fc7-87e0-a75ad7a87b48", "value": "12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1FI:lIt4kt0Kd6F6CNzYhUiEWEYcwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160931, "uuid": "52e1e035-6fd9-4385-8e39-66c78fce5942", "value": 759627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160931, "uuid": "24dc7989-f89a-4baf-bd31-2c55faf4acfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160931, "uuid": "7704a923-5b32-49dd-8c94-8999564edcac", "value": "virussign.com_b38eb0c41a03889bb577584afdb976e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e09d647-25e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Floxif)", "timestamp": 1774181026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774181026, "uuid": "711e6372-4504-41fb-bac4-a15041582c35", "comment": "Malware payload (Floxif)", "value": "4a7ca379457aa2fb942a90fb8f0c0753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774181026, "uuid": "73b7f76f-02c7-4d25-8b9d-f729f9c29e63", "comment": "Malware payload (Floxif)", "value": "368a7aaada192c1cbafbe01ad9bc683cc3acdc777859dfab424878910b2ea64e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774181026, "uuid": "b828277f-435c-4e44-9ac5-a147a3fd52d8", "comment": "Malware payload (Floxif)", "value": "4749aba0ec0af6967f9cb58e6719c868e70c85c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774181026, "uuid": "50863a7a-90ff-461d-9fa3-08acbb216e9b", "comment": "Malware payload (Floxif)", "value": "48dbd307a1d558e49709a295a8b440058097ee92b71b7d344506bcffaadba84334305262cef44184f312cfe3ff531c70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774181026, "uuid": "ba82364d-644b-4da8-a3f9-4befc8409e1d", "value": "T13AE408E06240F65FF2C09A336FD88B720979F92DC9CA915767402FAA59350F26736633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774181026, "uuid": "c297500a-b1ca-46a6-93e2-4282a2be00ce", "value": "afa785ab09891f33af84b69a4267bd2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774181026, "uuid": "5b223ee0-fa96-4384-9db0-9458ae06f638", "value": "12288:XubXcT6afJcLln5QwnVWqqPIBONhxsU/EbBjvrEH7Y:XurV90r/xsU/EhrEH7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774181026, "uuid": "acd041e4-8f27-4313-a7f8-9dd642764f29", "value": 681927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774181026, "uuid": "2de0e092-37e0-49b1-a5eb-5f57b759dd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774181026, "uuid": "e26cf5ea-3dec-4b20-8c41-716507f1546d", "value": "368a7aaada192c1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd92acb0-25e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774180515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180515, "uuid": "e7a99efd-4125-4791-85e6-19c69304135e", "comment": "Malware payload (Gh0stRAT)", "value": "90960132a338c092d88c6fea5b2f9a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180515, "uuid": "b0b4fd2a-341e-488f-bced-bd392f41c332", "comment": "Malware payload (Gh0stRAT)", "value": "3776cfbfb90c8e78ec7a6b55a8a37e3ea918ac3caa7065e432271f5054d6688f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180515, "uuid": "4a98c081-e0d2-4f0e-a9a7-6da6a274e73f", "comment": "Malware payload (Gh0stRAT)", "value": "7745c2456b108062218389a7ae9444395dc34a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180515, "uuid": "0801198d-a926-4c3f-ba61-d7bee6d3c6f4", "comment": "Malware payload (Gh0stRAT)", "value": "325b47a2f75e93ffe0cebeca3805b2219ce22125079c2c56aeb445f687d55a50d571821d562bc219fa1511546e634e6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180515, "uuid": "933c5798-5389-4237-adf2-4fe460ef0da4", "value": "T12E5412E01A64D42FE0A50172D6AAE63266F0ECC07C660B2757E1BA1E76D440FFD39736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180515, "uuid": "785598ca-701d-40ad-a98d-78e2e3153517", "value": "8d06ff0f301182c5ba233d45a52ee9ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180515, "uuid": "9d80b557-76ac-442e-8afc-b298617eb38b", "value": "6144:gQJf3uMxrbLgEN6S7KzA5x3S5+y3D82oC0UdkgxgfOqsG7HC:nJ130ENL7kArI+y3XipfOK7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774180515, "uuid": "8b4b11d5-19db-4bb1-87c5-8dd7cf4f34b2", "value": 288607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774180515, "uuid": "689c5133-93bc-480d-936f-3565d4c905ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180515, "uuid": "863c75d2-3427-457a-bb11-cacba5c35836", "value": "3776cfbfb90c8e78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60345324-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160924, "uuid": "1d3d6c07-321e-43ff-998e-0990d31a34e3", "comment": "Malware payload", "value": "b082e03688fff14ce9f6d062c1a41d00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160924, "uuid": "10cda453-2ee1-4e91-874d-187ef5a0776d", "comment": "Malware payload", "value": "37e5f03feec4e01dda142afcafdaacc137cdfec4f895e80307785b9620caa25c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160924, "uuid": "6deb00b1-f211-4eb5-9f63-6c2985c4e4f2", "comment": "Malware payload", "value": "0953bd840bb1acb3a588d2e23d1ce024f4c87583", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160924, "uuid": "ad00693c-d83b-4637-b9ee-ed2f2823d773", "comment": "Malware payload", "value": "e3416dd9bc3ee75cf4010054ff2cdc4be2dc62a3d5143ae015846e9f7bf1a90f34eb41cc23c4cfbdc940b85a8e4aa50f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160924, "uuid": "a140eee8-8026-4811-838d-cf97a6078de4", "value": "T1FF242B13F9D18971C0B0D9F88D8A82157234BAB9FD371BDBA6DE0544AD6D280AD2D8D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160924, "uuid": "7d5fd5c6-2f79-40c5-b6b1-2fa15dc25937", "value": "384:8g/JX0fiiTObxJDV5NxoXTpl0JmJGQjwXa3qLKTnRqRyN9Z8V:LJX0fiiqx/43JGQMXa3qWTnoy9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160924, "uuid": "eba6be56-0748-417d-912f-976a3edd8d6c", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160924, "uuid": "6cbc38c1-cb75-4864-9a22-ca0d27bc277e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160924, "uuid": "e11b88b6-9c37-4d2a-adb2-702b513898da", "value": "virussign.com_b082e03688fff14ce9f6d062c1a41d00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92bca415-2633-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774213837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774213837, "uuid": "e0854ef1-655d-43ed-868f-609712c6d1ee", "comment": "Malware payload (NirCmd)", "value": "567108fa90e365fabd074702833adeb8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774213837, "uuid": "8780c468-dd25-46ba-a7ce-97914a5409d9", "comment": "Malware payload (NirCmd)", "value": "388438dc99adfc89ff8585d4214339c33a9ee07c57881892ff670e04e2b0e1ad", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774213837, "uuid": "72d121e4-b0b3-4434-b6f6-f556459f1936", "comment": "Malware payload (NirCmd)", "value": "bc857b6ad569167e809eb04b39eb6d51c3fe6375", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774213837, "uuid": "80f055c8-8312-4200-b202-0e40dcd0153b", "comment": "Malware payload (NirCmd)", "value": "d0c99bfd67767e553912a6c8bac22cfb0663118617060989adc59a8e52936c8378273bfce88852955983b872bbd230fe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774213837, "uuid": "7a78e2e4-34cf-440e-8ed9-6064cfe09b4c", "value": "T19CA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774213837, "uuid": "7deba2a1-8a19-4d1d-a159-7a739dda531b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774213837, "uuid": "b7bf4ff6-9142-47b4-ad58-9641d3ecd4bc", "value": "49152:ABRbTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:adTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774213837, "uuid": "5331da5b-5c2f-426f-a55a-eb9d02887cf6", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774213837, "uuid": "e54b4da6-d803-4bfd-9fc4-8cf6c42cedaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774213837, "uuid": "0e13f90f-8bd9-4054-9fbe-86a4c492ec4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5521e224-2624-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774207291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207291, "uuid": "ba873947-1394-4e53-a585-2378841c4767", "comment": "Malware payload (LummaStealer)", "value": "ac9c69e05519ec6d00c6b2c1829969f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207291, "uuid": "366d0979-d356-4620-a6b7-e004a47ca1b1", "comment": "Malware payload (LummaStealer)", "value": "3b1bc21a8d1b6dbadfe4ca592f7fc3321b3691e3d79e659a886f61b6c1936913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207291, "uuid": "0caa49b3-6867-4133-ac00-52a97f8aff71", "comment": "Malware payload (LummaStealer)", "value": "b8252f681713bfedab7b8de284382940d1648b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207291, "uuid": "d8deabfb-6db0-4575-bdb7-6504d8f7fbf6", "comment": "Malware payload (LummaStealer)", "value": "75243758dd2ad02662e64a0e8648b025a3ab33f42320640775b10da99cfe01b8dd88cbdb51f710009a8bcc07bee338e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207291, "uuid": "97dfee42-66d3-4efd-b265-848b4e9e2e8a", "value": "T104D46DC1794190F3C4962D340131667B2E742B7287399CFBC44728DA9AB9DBB82BD277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207291, "uuid": "cc0602de-e599-41a0-a1ec-1caeb079187b", "value": "67ed13e9a25d0826b501a14feab4ebce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207291, "uuid": "1a8302e2-8e00-4a64-a480-24b9c80a9c64", "value": "12288:XFi0ZFfd5Rl1kU4nO55r/fI0vXkw1PBFpCzZJPgRpVdbMe:XFi0fd5Rl1RJ1AZk5FpaLIRpnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774207291, "uuid": "3d6e2e69-2742-4ba8-a25d-7fa737887f76", "value": 647880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774207291, "uuid": "31962c4c-e181-4685-be73-b27fd8b926a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207291, "uuid": "e1fed262-fe64-49b9-965e-44b145c31bdc", "value": "3b1bc21a8d1b6dbadfe4ca592f7fc3321b3691e3d79e659a886f61b6c1936913.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a479419c-2624-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774207424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207424, "uuid": "659913cb-b83a-4621-9dac-c21349914c69", "comment": "Malware payload", "value": "08451a5076f92e946829ecf302443acc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207424, "uuid": "d4bed22d-47f0-40c3-973a-3632d03d0402", "comment": "Malware payload", "value": "3f4c9b68876000a2cf20ba8804cbb7fa74064a8dd39253733371486d2a8fc83a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207424, "uuid": "0b23164e-9111-4fdb-83d0-953249ad5131", "comment": "Malware payload", "value": "47707daf9853cd4ecb3c872b18ff13d600546108", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207424, "uuid": "9a51d65c-f5cd-4f98-9b32-708dadcba0fc", "comment": "Malware payload", "value": "c61c70bea7911e44a42c8d7a0e01d70fd29396614e06fb1e34fcdc3cf102b025b3edeba74126120f74ac3599dfade2d4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207424, "uuid": "9c0344a1-ab33-4cd3-bd74-24add5ee69b5", "value": "T185A5F18B9B3550ACF2450F3C299FE5B4E8056E9C7C68DCC88A55BF50897FC61BB2B019", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207424, "uuid": "e0851039-719e-4430-a902-412b391ac65e", "value": "49152:+V33Z5FrZ1Pet5V3ry8LmfM1AdwwN4ocWeOuoS6/euyz:6zVZ1PetH3e8SfgRWehoS6/en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774207424, "uuid": "b7602e0a-7a3d-4a90-86cd-373ad2d4f89a", "value": 2216938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774207424, "uuid": "f51585fe-f3e0-4f8d-80f5-4b439013b5b8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207424, "uuid": "bb632a87-9c1d-42a1-9ef6-0358629ca604", "value": "AndroidKiller_v1.0_MADE_BY_PbCat (SFILE.MOBI).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02d4c68-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1774161112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161112, "uuid": "0beae69b-fc16-406d-b89d-6ef19f61e331", "comment": "Malware payload (Blackmoon)", "value": "ef2456d50eec4e80a4ba7f212cb050c0", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161112, "uuid": "798b4112-2d24-4bb5-b602-147a5944e977", "comment": "Malware payload (Blackmoon)", "value": "407eb9f9d55687cd6d532600d4ad5846073f8f46a540fb71d04d4bbe2cfa0332", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161112, "uuid": "bd9429e4-2b5c-4170-8195-3f2dd7faa05f", "comment": "Malware payload (Blackmoon)", "value": "01dd8f844eeb1506458a858351e11cd05e9db5b1", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161112, "uuid": "1f3f92b0-68b0-45c1-8122-1a1f7f960a62", "comment": "Malware payload (Blackmoon)", "value": "b14486a6b44a20f9ce7238b1366435ae2f9a8a21dbd8813adf14e41cfc0b586b9b5d9c8d7ca8b25eac4d9ee914f3bc37", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161112, "uuid": "68413862-6c8e-408e-bac8-2e70419d2de3", "value": "T132A4A6B21F3DE5B7E6B0F47056A91164288EB67799C919F050E213880B79CC1D9C2EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161112, "uuid": "e7d27fac-8201-4ed3-92e9-1bbecb32d7a4", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161112, "uuid": "0af2acaa-36cc-4391-b228-0338d3100dbf", "value": "6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe0dR:q7Tc2NYHUrAwfMp3CDAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161112, "uuid": "699fdd70-048f-4011-97ab-7fd2d666a837", "value": 468995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161112, "uuid": "721a3204-c1e5-4cfc-b93f-4c49e6e1010c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161112, "uuid": "a4160ef3-520f-4ac5-9780-32fe7c491612", "value": "virussign.com_ef2456d50eec4e80a4ba7f212cb050c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0effe3-263d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774218146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774218146, "uuid": "43bcd2d0-a0ed-4b99-8cb7-2e3a8b8ca67c", "comment": "Malware payload (NetSupport)", "value": "79b36bf828eea1e58bf5bf3155b04973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774218146, "uuid": "725c75ce-6405-4028-b333-961e40168375", "comment": "Malware payload (NetSupport)", "value": "40ddcbcad021bd8594ad0e9d43cfa719eb3b54664bd910281a79cb47c7cf6f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774218146, "uuid": "47001f12-33bb-4877-9553-b9a146397239", "comment": "Malware payload (NetSupport)", "value": "ec213fd0610ee74abf6ef2b452a6279d4cf03eec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774218146, "uuid": "1a445497-df75-4ea0-bd0d-336f846ccfd4", "comment": "Malware payload (NetSupport)", "value": "470a0a6c4c7b5c601f3a8878c3c1202ae00eaf35fd48cd3a483dc29d7eaf1a7115033e985461646b0732252f53eef778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774218146, "uuid": "5e12e584-9fbb-4f9a-a32f-eee3a4a22348", "value": "T186C55C07FCA114B9C1AEA1378623A5617A717C451F3223CB3A90B3782F73BE49A75764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774218146, "uuid": "ffe4ad7e-8ae9-42e5-89e0-ccb4372386a9", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774218146, "uuid": "3519ff96-a624-474c-b483-34b1f68b75d1", "value": "49152:dEJK2j5SwilyUzSvFUw+HCGBWj9Qc3n91:dECdyUtH1491", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774218146, "uuid": "4fd65a85-4076-4d75-aa21-a6deed71bc3c", "value": 2542080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774218146, "uuid": "711cca21-bd4a-47d1-9063-6c113256df89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774218146, "uuid": "4510aad5-777d-4dc6-8fea-dac7d668c911", "value": "SecuriteInfo.com.Win64.MalwareX-gen.42797115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38dba4e4-25f1-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774185339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185339, "uuid": "4403edfa-e03c-4c11-8c48-aa48f0177a6c", "comment": "Malware payload (AsyncRAT)", "value": "41686f7c5fce822cd33b6b0d0192086f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185339, "uuid": "2f4e050e-3c67-4015-979d-9aadc788ec66", "comment": "Malware payload (AsyncRAT)", "value": "4128be0ab78add387ead049f06dbdc31e371a04d0347fc9944c38c441297aeef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185339, "uuid": "a46643e1-46bf-4eb8-b6e6-7fde913783c3", "comment": "Malware payload (AsyncRAT)", "value": "69f6d6f0a8ded265924e8dfa94c57339f8b79ef3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185339, "uuid": "f78c4b50-0bcc-4280-9ea0-39b1910dbdb3", "comment": "Malware payload (AsyncRAT)", "value": "5b893b000d0e9a6744ab45213a30d81e6e02598b567137f80f90fddbb0ccb0e254b64bbbf2f2d2596606ebb3b9bf43a7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185339, "uuid": "c290d962-8f3f-4153-be31-5144447c2901", "value": "T188436C1C77F64125E0FFAFF159F67152C636F227A822D61F24E9018B1723A84CA417E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185339, "uuid": "6325bef5-9efe-404e-9888-3153a20c7e33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185339, "uuid": "920572a6-845d-4e74-b9a7-db7dcb026d3f", "value": "1536:dVP4JMRnVivQ8j2S0kbKJBviQ6Qa59OZYr:dVAJM/4Q62S0kbKLiQ5a59OZYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185339, "uuid": "5513f489-f1d9-4944-9eff-83d8baa7f969", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185339, "uuid": "f1744465-ac67-478e-a8ff-9feb89dae32e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185339, "uuid": "4e710fd9-36a2-4db7-aff8-57b72ac484da", "value": "NitroGen2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaddae6-25cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774169028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774169028, "uuid": "7dbe153e-35ec-481b-8ecc-2315100925ff", "comment": "Malware payload", "value": "f3a79f381d3fc8ebd008fb1c901990e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774169028, "uuid": "c83dc9b0-c6a2-4f3b-a6eb-f911554d5ddd", "comment": "Malware payload", "value": "436f1bc944071cfd32a8f6bd3efb3736d40ef39a8a8510e134b92da88ccf920d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774169028, "uuid": "742430eb-fce0-4039-8a57-f467e69557d6", "comment": "Malware payload", "value": "10fbb4d33dab3ebb8ec12ce593d518b461f6e904", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774169028, "uuid": "976701c8-9a89-4ce4-98e9-851895af138c", "comment": "Malware payload", "value": "cef68252bf7685fef89e20ff225e6135e837e01e04b3d762fafc675b7605ee051cb3f32fcbe94d9c3fb2360ddaede916", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774169028, "uuid": "e14fd980-aa2f-4a8d-8fba-fcc9a8cc51f1", "value": "T1AE925DB412896C79FBD1CE39AF3C6F4DADE882C42124A3ACBA4F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774169028, "uuid": "877dde22-f62b-46df-93fe-22c15c0e7818", "value": "384:V/YMKQcuQpWx+BL0SWL0gWzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:xYVQ8i+BL0SI01zsP4cbddr7zsP4cbdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774169028, "uuid": "5d75eef5-4585-4105-a472-18fce9df1cc4", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774169028, "uuid": "1e1bc96b-b3c1-45e9-8388-d78ba354792e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774169028, "uuid": "aecf4f39-60b7-48de-8234-aa36174246d4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705b1d3a-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Grok)", "timestamp": 1774160521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160521, "uuid": "90952d8e-518b-454d-9c6d-81ca33b773ce", "comment": "Malware payload (Grok)", "value": "24a6ec8ebf9c0867ed1c097f4a653b8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grok", "colour": "#62B8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160521, "uuid": "45ebb698-26b1-45d0-828d-4db5cd1f33d6", "comment": "Malware payload (Grok)", "value": "441f2a6775621af8c5d1ead7082e9573ad878bc90675ed55f86abfc8a9e8cc6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grok", "colour": "#62B8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160521, "uuid": "c14dbb4f-7ed4-4a9d-a8a5-54277ce35b69", "comment": "Malware payload (Grok)", "value": "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grok", "colour": "#62B8BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160521, "uuid": "10e69027-e11a-49d2-b970-b9cbc520be90", "comment": "Malware payload (Grok)", "value": "b68b659d4336bf6f2f97bb0ed07b87bc6bb5e80fd71fdc6219be7900917d582c27d8986c3c203b6bfcdde4da3bf5cc0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grok", "colour": "#62B8BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160521, "uuid": "f5d971e2-0d6f-4e3a-a415-fde6b515741e", "value": "T1EDF35A81A3660097D2BBC77685D78613F7B2B40427274BCF8B904A749F677E46C3A3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160521, "uuid": "f3e21040-4b3a-4fcb-a4d9-54c5d0257116", "value": "d8b4b3e994e78c3549d970d6b09456ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160521, "uuid": "9f94c9dd-e683-4abc-8278-309b3320e735", "value": "3072:wdWpskNQbkWD95SQcA0vWNc2gbDabSbosH4/h9:wdW/NCkU4QcA0ONc2YabKosH43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160521, "uuid": "6fe24e5b-ddb0-432d-ac7a-c6727fddcd30", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160521, "uuid": "01fa9c2c-b699-4a51-b401-7f602db34639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160521, "uuid": "370c7b34-56de-4ce5-9470-cdd172abccc5", "value": "GROK_24A6EC8EBF9C0867ED1C097F4A653B8D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852a0eac-25ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774170435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774170435, "uuid": "28248275-530e-4a4a-ae96-fa1070109112", "comment": "Malware payload (AsyncRAT)", "value": "32809ed5df594cfedd3aa90007e0e9a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774170435, "uuid": "d940a726-d02c-4600-992f-93af1d689ade", "comment": "Malware payload (AsyncRAT)", "value": "4512229b8a1bfb4d3558cdf26cc4cf386394f4bc2411710e99cb7321e770a4e2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774170435, "uuid": "7df2aa30-d012-45c3-87ca-203af8007fe2", "comment": "Malware payload (AsyncRAT)", "value": "018a9e50f5d2c83dc09e6ec99bab6ab59c4bac19", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774170435, "uuid": "f1d07a79-8b09-427c-ba3b-ce1d29a88d53", "comment": "Malware payload (AsyncRAT)", "value": "440fb6d82586162edf5ed3badcb39e9b652debd9a9450606e9b18b72d8e995643a6091a680f5cd0c57a262924f93e035", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774170435, "uuid": "1cd3708f-6c5d-4b2e-a32d-2158770a57b3", "value": "T160A5E0A259D805D728232A3F8F29B68DA4A04F44ECE1DF7BEF7344A964B4B064D57C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774170435, "uuid": "62e537f3-86c5-4de6-aa4e-c82b6b73a06a", "value": "192:vJ1kUZepim+8Iam+i6F2d/YYcJY0JCpQsF07/fw+U0teqMFwiFhS115Gy+0Z0YXm:NHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774170435, "uuid": "5d81d352-fa4e-4caf-bfb8-5fd36d9ea528", "value": 2078595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774170435, "uuid": "a47c9306-fa13-4701-826e-8dd9e5561bc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774170435, "uuid": "b5628849-f23f-4f0a-ad87-c6de97b1dfe2", "value": "0005AutoActoEjecutivoRdo52ADAEFCB2AC40BB6472428D9034AApdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975cfb3f-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (MysticStealer)", "timestamp": 1774160587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160587, "uuid": "57734d0d-1d9a-43eb-ae63-b4928a874a67", "comment": "Malware payload (MysticStealer)", "value": "f8bb86bcdbeb8c6728fa8798ce11ed7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160587, "uuid": "d6df2c59-92b3-4eb0-acfa-bb396c7e2656", "comment": "Malware payload (MysticStealer)", "value": "47439044a81b96be0bb34e544da881a393a30f0272616f52f54405b4bf288c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160587, "uuid": "ba2f536c-ec26-445d-907c-1710cab17b25", "comment": "Malware payload (MysticStealer)", "value": "0ea2a73c6e5b55e986e7ef3d8568cb86b09d1ca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160587, "uuid": "62d78476-88ff-4148-88f7-448e9c851df8", "comment": "Malware payload (MysticStealer)", "value": "4d2862c663ef8af62c4552b3b61cb45ae1687423e7cc9b7f509fe8bc55f708bec610a51e0e6729b76b7beadd50a6c1c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160587, "uuid": "abe503cc-5afe-4072-9851-978c63616b1b", "value": "T12A347E00F59184F3E87912B94DEBA325D83D3C28046DCD9B97C66E5ACD613F0932ADAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160587, "uuid": "cb65ca68-eb01-4654-9694-a4a09b2c415f", "value": "8f2649698c183ba2b52e5e425852109d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160587, "uuid": "866aff49-70f5-48ff-a2bb-f1ff15f07eb9", "value": "3072:UNKot6d7AU/PnfYnNAJVcops7muiysvEEgkADMv+dnD85NCp7nJM1vjyD3ux2CFO:S7IMWfYnNKUnnsZgkLgDSin61vjBwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160587, "uuid": "05152eac-5ade-498f-ab04-1f5861fc6acb", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160587, "uuid": "a50a4010-c45f-4818-947b-4962b69461ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160587, "uuid": "46d0cd5f-d570-435b-90d0-fc2fc3205715", "value": "mystic-stealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d300270-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208996, "uuid": "2363a5cf-88a0-40b0-ac05-46119afd04d2", "comment": "Malware payload (Mirai)", "value": "c2f7507f788d18cf6dcea104d239d660", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208996, "uuid": "84a7d007-6bc0-4f31-8b5b-1b28dd3a98f2", "comment": "Malware payload (Mirai)", "value": "47fcc3426f3d0e563b5c7692b0ea2a22321fa804747d7228c93a2c9dd45b7bc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208996, "uuid": "0caa43a3-8c0d-43f3-95ee-36d525816be7", "comment": "Malware payload (Mirai)", "value": "1d2d45cd81c072c8b9a82ff4b4fcca4123c99160", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208996, "uuid": "59edb965-650f-43dc-9655-b74a95b3f5d9", "comment": "Malware payload (Mirai)", "value": "61523618e798d83c16a8873a62a402f0cb38da75970a540327d050a07a43ff81dfe702eb26d4dd76353512be39f27f10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208996, "uuid": "9e53ffb1-b9e8-4695-94d6-6d0f69154eb9", "value": "T1DF93AE22E828ADD4C1909674B4F4CF7A8733E460A1D72EF74996C2795483EECF5483B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208996, "uuid": "e2fb1b02-c94f-49e5-916d-9e75b3956e22", "value": "1536:mALrH2vuLsL5DsSQ1sVMuqcfq0NU/K//klKLFPAlCgsVPYcGX1zZ:mKzcy12/fqSUi/fFPAlAVw5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208996, "uuid": "ad576f5f-ceef-44a6-b30c-4ee8bc7cb0d7", "value": 92764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208996, "uuid": "d7c6ed63-4a8d-419c-8fc0-1664a1424f2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208996, "uuid": "d829df08-d7a4-4d98-828e-45e705340c42", "value": "tux.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497e84c7-25f2-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1774185797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185797, "uuid": "c20ba5bc-e153-48e3-8a40-b0a75457e3b4", "comment": "Malware payload (SilentNet)", "value": "1aaee38319509246d5d6e7b9521781ea", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185797, "uuid": "951e651f-6397-4990-b221-a0940756905a", "comment": "Malware payload (SilentNet)", "value": "49b1c9505499653288190b47055e0100f6c41ff2cfd026e82ad2bdb4727ccd25", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185797, "uuid": "40e44e23-445f-45ca-b5f1-ba67541020c0", "comment": "Malware payload (SilentNet)", "value": "961e74b6413136576a3d3543f612b92c986b732b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185797, "uuid": "a20ccafa-691f-403c-b192-9e6d78ce0809", "comment": "Malware payload (SilentNet)", "value": "2a826313fa32184e8daa00d378c1e115eaf9b57498ecb03c83911d18ea86624507b21cb797bd8cc4c67c856449844f2f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185797, "uuid": "24055a80-1cfb-4194-83d5-33f6f0a714c5", "value": "T1811533903BD527F2D1BBDE6196A7212313B31580A35B363B017F3F984AE05DE25076BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185797, "uuid": "7961a65f-0201-4b0e-823f-947c98ad548f", "value": "24576:qljGwHhmG5ksmjf7jpkplD8aKkAr/irgHTHY843UbHCGy:mL4Gl4Djpwlyx/icTOUbTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185797, "uuid": "37c99853-772d-4756-ae95-f347c2eeda14", "value": 921290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185797, "uuid": "1e6d74fa-be61-4851-9d4a-b834633e0ac3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185797, "uuid": "affc5caa-76bc-42d9-8594-af3fc39909be", "value": "Dupe 1.21.-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160313ef-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160799, "uuid": "40798132-e6a2-4cfe-83ef-1e4feac9642a", "comment": "Malware payload (KawaiiUnicorn)", "value": "8d6d63d77f1c81bc09dd67eb3202e310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160799, "uuid": "5b904f5c-ee08-4745-8e6f-2ddf9ea415d2", "comment": "Malware payload (KawaiiUnicorn)", "value": "4ac97d113956c50521cce16816c6afaecb7b8633b5a8905d9336bbeee4b597a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160799, "uuid": "0d2b7423-b8b2-48d8-bad7-cf1a492b2d96", "comment": "Malware payload (KawaiiUnicorn)", "value": "f00f0b2cf4d3a65aec1ada7c832efbd70c586c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160799, "uuid": "f4683b65-0833-4887-adef-f0bff7ca23cb", "comment": "Malware payload (KawaiiUnicorn)", "value": "3032ebdd661a23e464b98ded2bf0ab2c962b4ecc075606eaacf006c61d4a975d7c8b4855b96cdde0853a54d9c31ec82d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160799, "uuid": "1c65aa1d-d10c-44cf-a542-c581521a29a6", "value": "T15CA4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160799, "uuid": "dab7e4eb-66ec-4da1-802b-10b675a6e115", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160799, "uuid": "7205e1cb-105f-4b7c-a861-7504e33ad672", "value": "3072:pFgToHdxFQXj2OCRPz3gyf+SlCTU/xiTPmHxU/X39BME3aBZeala:pF0otmj27PDgyfT4229BhqBZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160799, "uuid": "768015c1-7dab-4d8e-89ac-654f7866b2ec", "value": 479244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160799, "uuid": "73c9d07c-7451-4269-8352-ac792b8335b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160799, "uuid": "7c46ca7b-6e22-4de9-afa6-a0a154fdab8d", "value": "virussign.com_8d6d63d77f1c81bc09dd67eb3202e310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd01424-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160702, "uuid": "2e430d11-a4e0-4463-b24b-1ffdc39847c3", "comment": "Malware payload (KawaiiUnicorn)", "value": "41b011aa465755f36d71d03fca080fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160702, "uuid": "4eb44f30-9fc3-4f79-bb00-fd1cb6b23b83", "comment": "Malware payload (KawaiiUnicorn)", "value": "4b2a8c64b47ebb034ba058c76ad93e135ed8adeecd98d9c8dd9e2a4f48e5598c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160702, "uuid": "cfa7de42-9075-42bf-98e8-0338b43f5cee", "comment": "Malware payload (KawaiiUnicorn)", "value": "00199286af2e5d02544b5756442e02e525b2c500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160702, "uuid": "898b12ef-1c17-4f1b-a436-c2e37a1e0c43", "comment": "Malware payload (KawaiiUnicorn)", "value": "8e1d2932c0aeabe2f1af28cc776727a7db322ce381e033cd7e5947cf0eb8f5d0f4480ea68e062539c3d25d3d228648b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160702, "uuid": "7d1b9338-37dd-4e32-8d26-04fc4fe3e7e5", "value": "T1F5A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160702, "uuid": "044849e4-d535-4a9b-963e-243e1f9b12d9", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160702, "uuid": "e509a95c-3175-4555-9603-5280a0b636d4", "value": "3072:wF2uogKcF0Xj2OChPz3gqfjSlCBjuxpBPmHx1B/pK6UEOQs6ek84:wFHo6qj2TPDgqfc3AVK6pfs6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160702, "uuid": "d2fb6b13-f80e-415b-b243-8a2bec531733", "value": 479253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160702, "uuid": "616a2c99-06ee-4d5a-a896-059fe4ff63c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160702, "uuid": "8de2f32e-ffff-417d-8f58-59e1fed5f813", "value": "virussign.com_41b011aa465755f36d71d03fca080fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfbe977-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208994, "uuid": "6fd0ffb8-105d-4b09-99b3-04461315b336", "comment": "Malware payload (Mirai)", "value": "a18ffa547df9f23a25f691fcfc5121de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208994, "uuid": "276ff989-243f-4f3e-badd-33b7f335e27d", "comment": "Malware payload (Mirai)", "value": "4c2b21c9b013305c1f7d40351b1692dee7c86c72785ce53e27da621900b78ad5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208994, "uuid": "639600d6-db55-4c99-a375-27a2cf5ea62f", "comment": "Malware payload (Mirai)", "value": "9f934e6535aa8816b8a909bdc21cf7a6b460b99d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208994, "uuid": "7e0f9f4d-9aca-4554-ac33-0e5cb45393f7", "comment": "Malware payload (Mirai)", "value": "a2b116bfae6cf8af857aafd172def6bf2b18226308177c5ab90cb07e8ffa303d58498fca593da5b3add49e3c96dd7835", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208994, "uuid": "26ab7dcd-2dcd-4b17-9a72-cba6c675a993", "value": "T129B32946B8819B11C6C212BAFE1F118E331317BCE3DE72229D145B6077CB96B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208994, "uuid": "c7f1f25e-694c-49ad-aadd-05bcf1a5eb18", "value": "3072:CDvI+knE6U8KOj7fGalt3gKhZkiwijKPt:Wv9/d8KOj7Gaz3TwiwFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208994, "uuid": "6724ee99-d728-4e7c-ad16-15791649f467", "value": 112044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208994, "uuid": "5ca2b205-ac62-4f54-8bd9-acfe2d411db1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208994, "uuid": "d362b953-16fb-4a4e-9906-5792aaf3f7fd", "value": "tux.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246f8a10-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1774160824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160824, "uuid": "194fe962-9e88-4496-ba31-fe46093c8d3c", "comment": "Malware payload (Blackmoon)", "value": "9ebf83d1954b7d56561d622d95a7a190", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160824, "uuid": "4da420cc-bca8-48c0-a7ee-bad32c92bf2a", "comment": "Malware payload (Blackmoon)", "value": "4d66abffece9cb6373c661fb0a27f61d7578e9348ed68e9220bc1fd8ea06a2ef", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160824, "uuid": "963e4979-728f-453e-8963-b43bc5a4cb31", "comment": "Malware payload (Blackmoon)", "value": "548246d7b355499f2149a4b18b0448566ef345b0", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160824, "uuid": "86b1c740-480f-4c3d-9593-0d6d5144ac18", "comment": "Malware payload (Blackmoon)", "value": "909604789310b87600586582e305b63499dbcb0686df5863fee365af24ad3e00c584500c2bbc1968efa377636b3d7c9c", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160824, "uuid": "4b579ed5-796d-449f-9937-d0180423bc1c", "value": "T16FA4A6B21F3DE5B7E6B0F47056A91164288EB67789C919F050E223881B79CC1D9C2DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160824, "uuid": "41a2c7e0-8438-4726-880f-893daa50e472", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160824, "uuid": "2dfd4833-c39f-4a0a-91d3-e2fd46edd434", "value": "6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160824, "uuid": "40b1996b-2199-4f30-a6d7-117b707958c7", "value": 468385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160824, "uuid": "e07eefb9-2b9d-41fd-a7c2-5736fe94158a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160824, "uuid": "182e21c9-1f40-447e-a5cc-2a804cea32cc", "value": "virussign.com_9ebf83d1954b7d56561d622d95a7a190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14ecef9-2603-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774193272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193272, "uuid": "91454476-666c-4aaa-a757-1fa22726cd33", "comment": "Malware payload (LummaStealer)", "value": "94160399f5030e024c628077c41baa70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193272, "uuid": "4e3ab89e-4b55-4a0e-bdc5-2df77f5b1aa3", "comment": "Malware payload (LummaStealer)", "value": "4d839446729b62e3790a830b55e220bb3038ac807bbbbcdaa15f88ab90b825f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193272, "uuid": "afb62931-5dfc-4ca4-a849-a3df8324d553", "comment": "Malware payload (LummaStealer)", "value": "22c59a899289470cd69ff750b593d658dc22974d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193272, "uuid": "4447191b-19b9-4355-a26b-23d28cc91d73", "comment": "Malware payload (LummaStealer)", "value": "9f0cc8fd4dcc3754b375dcbedefec7db63694e5b702724352e6d3ccc2aaa25013cb5cd50ddeed165b17f2821f9445995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193272, "uuid": "e8bdee6e-712e-47e5-acfd-66944cd932c6", "value": "T10AA46B16C6A949E2E58B133821E67B3B8D207B1007345EE34AC4DECFB95EDD7462C726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193272, "uuid": "b0f0eafd-7072-4c15-85fd-5dc350f8326d", "value": "ecd3d21718fb9c31efde10d52ca666f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193272, "uuid": "b46bd2ed-0534-46df-ada2-dcf39373f75d", "value": "6144:so4HXvnCuQlBHyS0zIrm09/67XQIPwES4J3PjYTMMAmJMJgJ2JKJtJmJtJXJtJQx:j4HXvA7HyYyK/QCEtJfjYTM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774193272, "uuid": "191d6ab7-ffe5-4934-9976-d6c13d2e6fec", "value": 468212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774193272, "uuid": "a9cd86f4-f25e-4bfd-8a42-d9cf8f11e0cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193272, "uuid": "4ef40d3d-d817-4837-8f10-489af335af01", "value": "4d839446729b62e3790a830b55e220bb3038ac807bbbbcdaa15f88ab90b825f7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32fbe83-25e0-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774178297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774178297, "uuid": "c666828b-ec87-4b73-acc5-60853206853f", "comment": "Malware payload (LummaStealer)", "value": "00dc20621623bcf37411d53576943f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774178297, "uuid": "ac606773-3a0b-43ed-b170-ab3250524097", "comment": "Malware payload (LummaStealer)", "value": "4fe36d61d79b38a29dd816d15cfba8cea3d40f304c8982ebc09748024d5250cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774178297, "uuid": "b8b886b5-1d0f-486d-8fe4-77b4b63b915b", "comment": "Malware payload (LummaStealer)", "value": "0e87cb233f3c56bcaf512e64c31bd2926799b1c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774178297, "uuid": "84a7ab8f-0653-463c-81f6-44e4deda54e3", "comment": "Malware payload (LummaStealer)", "value": "1314b56eef7103d2a631664c01b527af070268706e647081f8be80fbaa4e25311a81e2dda5fb5e6fdb2fb33f842c7045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774178297, "uuid": "af97a8b6-4e50-4620-9510-4fb617f23847", "value": "T10DA46B16D6A949E2E58B133821E77B3B8D107B1007245EE38AC4DECFB91EDD7462C726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774178297, "uuid": "c47fa79e-4348-4370-928b-fcc0821992a8", "value": "07af47d88dcc55c75a1c670f8daaabb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774178297, "uuid": "b91bffb8-5c5b-4389-9802-ffc9c9c10c4f", "value": "6144:Jo4HXvnCuQlBHyS0zIrm09/67XQIPwES4J3PjuTMMAtJSJtJrJ3JrJEJ+JrJEJoM:+4HXvA7HyYyK/QCEtJfjuTMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774178297, "uuid": "d9f548cd-78c6-4351-9abe-59f2288206b1", "value": 460744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774178297, "uuid": "5e9aebe2-6956-45e4-97ad-0f3b457fad62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774178297, "uuid": "dfbcf2be-2c50-45c7-ae26-6145a3a8616c", "value": "4fe36d61d79b38a29dd816d15cfba8cea3d40f304c8982ebc09748024d5250cb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf51128-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774160623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160623, "uuid": "e89ac8c2-a6e2-446b-8662-88336c0e28cc", "comment": "Malware payload (Snojan)", "value": "05f34eb9a87b136d272bfa9b718c6440", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160623, "uuid": "25d091f6-0f4b-442b-a57e-79cb1b488dee", "comment": "Malware payload (Snojan)", "value": "53e0c959d2e562075d89751c12491edd1fca766ce9f5ebc72c807e6f9ad1ea2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160623, "uuid": "1a0f90b2-1e60-461f-943a-9817e94e1076", "comment": "Malware payload (Snojan)", "value": "0b90051878827e32050ce9db09a2dbfe7fbca636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160623, "uuid": "f27d0960-7d36-49c4-8ada-6155b4b927dd", "comment": "Malware payload (Snojan)", "value": "0621f59ac3fdfbf843315fc16ad7e28553ddf32ce3c899e03973b1cd21dcd33e58d6b2e0dc45e3684d0ac80c26280c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160623, "uuid": "421e775f-fc8f-4301-a290-45df206db0ef", "value": "T12F345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160623, "uuid": "0950673c-60a9-4af1-b5f8-ee2187923393", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160623, "uuid": "0396f7ca-cf0a-40a6-a8eb-7db5b64938d5", "value": "3072:4J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/z/FnncroP9:8wDeM7iNEkgiOb31k1ECjJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160623, "uuid": "6e1fccec-5bf7-4a2c-a553-dd2ec203395c", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160623, "uuid": "35d598da-4d03-456c-b738-b2003e22c8ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160623, "uuid": "735990e6-e351-449d-adf8-db06a3c5430b", "value": "virussign.com_05f34eb9a87b136d272bfa9b718c6440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ce3109-25e5-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774180375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180375, "uuid": "0de4b526-90e5-436f-9966-6619dfb18016", "comment": "Malware payload (NetSupport)", "value": "bdbed7d44be0a800ee43126e1663039b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180375, "uuid": "aacfebf9-0de3-4a22-8bea-f876a95f1734", "comment": "Malware payload (NetSupport)", "value": "54744fa7f773915658777694e2284c1e1f5ed63334afe3f8fc4471c5e9e1cd96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180375, "uuid": "58281ed9-f9eb-453f-aa3a-78652a30db4b", "comment": "Malware payload (NetSupport)", "value": "0e0d451f122f166a712a3195d9d64a767cf6565e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180375, "uuid": "f68324e7-38ec-4c33-bc89-399020dabdb9", "comment": "Malware payload (NetSupport)", "value": "0ce4d5c99a5d442a0099c102de7eea9bf6d3661f2375cc6725eacc3cfe8a1e3f5d2a9a55d62d371dcb0e57f00c56cbb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180375, "uuid": "6657069c-b402-4d20-a896-4e0b3305c659", "value": "T1EAB56C0BFC6104F6D4AAA1318527A1517A707C452F2223CB2A5CB7781FB3BDC9A79BD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180375, "uuid": "112df7d9-620d-4a9d-b25d-0f7e54688fd3", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180375, "uuid": "8b0be663-395e-4929-bfb8-243c14fa98f0", "value": "24576:2wTX8dU40OySkEgnhRkSny/jETjopKPPSk8ciD/QvUSgv5NcFv:2wTMh0FSkEgw+y/ijIQc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774180375, "uuid": "67ebf354-466d-4977-b917-63f6d6fee63e", "value": 2432888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774180375, "uuid": "e85db83c-0a76-499a-b11a-481b9c55c2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180375, "uuid": "a98384bd-9fc1-4b06-905d-bf33b1c2e4ef", "value": "54744fa7f7739156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927fc36e-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161008, "uuid": "c3246b79-cf01-472c-b4e4-6b32d0ad90b1", "comment": "Malware payload (Berbew)", "value": "cfc706ff85023c98fe196951e30aefa0", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161008, "uuid": "54f6f52f-c4d8-474c-9488-8148a53bacc2", "comment": "Malware payload (Berbew)", "value": "5601eb09023210296350c4c312ddab59018e974c372f3944af3175147874a762", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161008, "uuid": "61bb925b-a487-4bf5-a060-e5c0526750a7", "comment": "Malware payload (Berbew)", "value": "82aa57be26e7415898fe0a2e940f821217eb7fd8", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161008, "uuid": "1686c9a6-7d3e-4c00-afc2-d59532963350", "comment": "Malware payload (Berbew)", "value": "7d323e7f8d1aae8b22ea94fbf45ce21267abc936f554968584b631bf3f9472007cefb62d076c8b2e72ba4c67b76930c8", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161008, "uuid": "439e1857-f171-4813-b297-9f80269471ea", "value": "T150D37D6F616DAF72C45D32F3286641DEE67E917A63FE8331B479840D8323E2485F6284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161008, "uuid": "8427be23-31b3-4bfb-a16d-6e72cddb9265", "value": "d195dd9ffad463d4a93ccdbc6f52582e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161008, "uuid": "4a911d88-0829-49d1-9672-79033d1e7cb9", "value": "3072:kGKq+loyEMk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:H+loyEMFtCApaH8m3QIvMWH5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161008, "uuid": "9045ffe4-1476-4b92-ae08-43fff4d30e9f", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161008, "uuid": "9c45fd29-e9f4-42ee-89ff-0717551964da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161008, "uuid": "b1e721ef-55e2-4794-8c8c-f22dafe613a5", "value": "virussign.com_cfc706ff85023c98fe196951e30aefa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea2d716-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1774160894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160894, "uuid": "c4c9f3e2-050b-41c0-98df-2ee93881f695", "comment": "Malware payload (Worm.Ramnit)", "value": "ae20ca8e06716a266e3d42684d1bc190", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160894, "uuid": "022c7c74-7a0f-4891-9bf4-cad684c745b6", "comment": "Malware payload (Worm.Ramnit)", "value": "57a0c3e671cca3737feec69673389805dafb16a59171d6c88184ee576c3cc532", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160894, "uuid": "73abc056-5161-420c-a34b-c711b9948e01", "comment": "Malware payload (Worm.Ramnit)", "value": "401aac8d3a074afef538ae72e80a14918814791b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160894, "uuid": "05caacaa-42b6-4dcf-9056-37f0815e30e7", "comment": "Malware payload (Worm.Ramnit)", "value": "654100a934132082ffadf18b0ded130a0a20dd687f3c405638e23f2d1ecdf996e07c29dcd355c19a1c281be889e45e08", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160894, "uuid": "08209c63-b0c6-43e7-b604-e9a8fe505487", "value": "T1AD712123A75244F3D6054F300B5B8982E2FFD27A0370442C5F0556193EE23A6E72AF49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160894, "uuid": "ee188a30-a6bf-4374-838f-930bfe91f0d7", "value": "b6f391375d741ab65301de3824d105be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160894, "uuid": "dc457ccd-c1f7-4ed5-8449-36497b35d889", "value": "24:eH1GSi9vPQeDR21SMwh0tYPFThtdnIUovRidLYH/hgU6:yOgqQ1hWMStdnapidc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160894, "uuid": "dc4308bd-406c-4dcc-8c00-834e5d1449aa", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160894, "uuid": "4b5e3a50-44d6-4b53-98d2-6d51e708861b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160894, "uuid": "d538817a-99fa-41e0-bfab-6fe51917622c", "value": "virussign.com_ae20ca8e06716a266e3d42684d1bc190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bda4048-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Sality)", "timestamp": 1774160917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160917, "uuid": "2dc6bdac-b28a-495d-b16a-88d37204655e", "comment": "Malware payload (Sality)", "value": "b039f37679824af9abe1fba217dc3a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160917, "uuid": "d08c87c7-b93c-43bf-a481-52fceb01dd51", "comment": "Malware payload (Sality)", "value": "57d128c3e78403bb933cfc6f20e5f0cf0fdf6fc437e20c71dc9c31bb2355bbea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160917, "uuid": "307322b6-7640-4b5d-b4f4-604df2449f91", "comment": "Malware payload (Sality)", "value": "060c07bd1e53b909ee9305c0dd4e96e9bf62abe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160917, "uuid": "0722076d-c7d9-4e8d-9402-2b4ef9244ad5", "comment": "Malware payload (Sality)", "value": "6d9004a2c140ae5256772068deaf4ba313fb11e7f649811dbf3361ff2514f029fcdf68a3a3630f47b0bf50b96b8d78cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160917, "uuid": "59dafe20-bfde-4fda-b890-d55c2a095871", "value": "T199A3F1C3F9929F73E65165784AFA3731D23B5C1729304967AACAD8DF2536B618C38320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160917, "uuid": "359f7316-2dce-4154-9c83-cff4a2c6fe1d", "value": "af417a432744d25669a269c31c292485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160917, "uuid": "123a8c73-a15b-4fa4-991c-0fbff8cb064a", "value": "1536:H3A7eDUAZeigZHGv7Y/L4MnHmR5Jr/jPUhQYS9rmV1RGg/kEakZVY4:H3lDU8VgZHe8cMnHwPLPUTWKH/Jhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160917, "uuid": "ac82e200-3105-4261-b77d-7b67dd888325", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160917, "uuid": "c42d0dcd-2203-4453-921b-31bc3c693946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160917, "uuid": "b26868fd-ca48-44f2-be6b-d51865ce2837", "value": "virussign.com_b039f37679824af9abe1fba217dc3a60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dac9346-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774160839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160839, "uuid": "1f1fb8dc-b7da-4da3-ac04-1c211b43529e", "comment": "Malware payload (Berbew)", "value": "a940aef6749b2a7ebb1cc79330277870", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160839, "uuid": "5939c271-4e9d-4409-9b7c-be03ea261794", "comment": "Malware payload (Berbew)", "value": "57e14edcc1d0346a33519613471e6f8686b7e8bfeadacad6c4742d992b700049", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160839, "uuid": "ab040c7f-beab-463b-bea6-1d2a69c07516", "comment": "Malware payload (Berbew)", "value": "078326440cfce1aeebf5d7b0d99ef061a0aba464", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160839, "uuid": "7de160a3-ac1d-4fce-989f-95e22efd76ff", "comment": "Malware payload (Berbew)", "value": "f2c6130f0208ea7732cce6ae3182457a2d4daa0812df021f2ac245640abec1f13d10eb8e36b5f3a31047644572a630a0", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160839, "uuid": "38850e2e-5f32-43a8-a576-77315ffbb28c", "value": "T135939E5F81213DABCE531E7828C2D03EA9E039A737FE9557CB544C8A04AA8589D7CF35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160839, "uuid": "83442d03-c650-4d69-817c-5828aaf6326c", "value": "ab20a25a6f2dff86eacdc55fb2b0acc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160839, "uuid": "64166b46-39cf-4b3f-a0d3-3f63bffeaeda", "value": "1536:dSQPv7Hvqr0iSo4Kgx+y6VpBmJNzq5ttTpIihicMOuv7BR9L4DT2EnINs:sQPeSoFgxV6VpuUtvIAi5v6+ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160839, "uuid": "f3744fba-c02f-47fc-8167-b658d281082b", "value": 96360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160839, "uuid": "b36a91b2-d16b-480d-ae86-6ec19c0e1129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160839, "uuid": "78cd7566-9ad1-4163-97ae-c692f4a5d9c6", "value": "virussign.com_a940aef6749b2a7ebb1cc79330277870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fa0aff-2636-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774214990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214990, "uuid": "c80f72aa-accd-45d8-a467-a7ce76343053", "comment": "Malware payload", "value": "124d4ec78746cf77c06398aea42da459", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214990, "uuid": "c79b9478-91cc-466c-b925-e60df735924c", "comment": "Malware payload", "value": "582d90287db6ab528ac342c7e3d77f5272132c28f62b248d4d0c6f85421fa8b1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214990, "uuid": "64a48c8a-d010-40a5-9e64-ee043577f81a", "comment": "Malware payload", "value": "e737229d88b8a57e3c54de9564a7cea400793d30", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214990, "uuid": "41d8d425-1797-4b34-a00f-64f522550fe3", "comment": "Malware payload", "value": "3ae1d4648acd60d2c8b759c9e1ff8935126a5a2aa026fc2ef957b2d668bbc347bd53dc96e68d003e0daf0f04072e305d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214990, "uuid": "9b38473d-418f-4fcf-b290-43229d0aff84", "value": "T17C963367025E9A6BD6DF63FE24B2D36EC488B1D4386A20C20B06F82F127D705E51DF91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214990, "uuid": "ea46e77a-fe15-408e-a710-0c4bd54b79ea", "value": "45f0b404d197612cc9f21f62dfcd882b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214990, "uuid": "024f2c8f-f1d3-4bf1-849f-07c8dac8aa39", "value": "196608:9Y7oStht/gkHgd9QinK3+ocgJSi8Ik80wwb8OmbLnRtMSUd:eTT/hHgdCJjk80ww8Om3Sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774214990, "uuid": "39be6622-4d1a-48e7-bbc4-4e6c04ad1220", "value": 8802648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774214990, "uuid": "6391e9bb-b7cf-43fc-8a96-1da40d2ac199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214990, "uuid": "98275725-8ea1-4178-a54a-e2fc31dbc395", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23a3fb1-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1774161142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161142, "uuid": "af691468-0d83-40b0-b69f-314cc002cfb4", "comment": "Malware payload (Blackmoon)", "value": "fabbf0f3bb22c1aef9caa63ce3082b20", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161142, "uuid": "46d3d163-9444-4f68-a003-e87c572809a5", "comment": "Malware payload (Blackmoon)", "value": "59328882b135b72ae457434b3f71d9a50b7624301bf71d18c33406b143dc8da3", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161142, "uuid": "2d29a80c-6eea-4444-a852-cebaa2cf4701", "comment": "Malware payload (Blackmoon)", "value": "6c46e919b89c35f19e15cacc2d82fc7d795b0cb3", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161142, "uuid": "7048aeb8-c440-4838-b882-c30086d374e5", "comment": "Malware payload (Blackmoon)", "value": "75a9064b0a6a6f252bedb0a8e3602611d2876f501a37ac8feb82c5d9a886ae1d456f502c3f1bf836737635334dc6e46c", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161142, "uuid": "1ff8d8bd-51d7-47ae-86d1-b00438f33189", "value": "T12193E1F6EF99A2B5D5A50E3449A5DD6C053631FB1C412EEC80A813C51FA62C66BC0CBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161142, "uuid": "97d59c7e-b7d4-49f1-a571-fe7f78957db7", "value": "cdf5bbb8693f29ef22aef04d2a161dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161142, "uuid": "084e25fa-c378-47d2-b0f0-e363ce453f97", "value": "1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/aFF:ymb3NkkiQ3mdBjFo73PYP1lri3K8ctCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161142, "uuid": "43dbc5b0-85d2-429a-8355-851be0d10302", "value": 92970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161142, "uuid": "85bf8a24-b2cf-41e8-8622-3ef6f34412bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161142, "uuid": "03110e98-f1d1-4def-9a0f-84c61b11ac02", "value": "virussign.com_fabbf0f3bb22c1aef9caa63ce3082b20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5418e16b-25ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Viking)", "timestamp": 1774184526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184526, "uuid": "f7c7809c-5bd5-46fb-ba9c-604d20a3225b", "comment": "Malware payload (Viking)", "value": "3e5034d9013d5b264ca9b8f44555edc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184526, "uuid": "2b951bef-4524-4591-a5e5-c8c616055541", "comment": "Malware payload (Viking)", "value": "5a2a9f705ffcb1f912aeb03d84164bdbf57480ca4f0af7a5f7db5590681ad6c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184526, "uuid": "1378fefa-3285-4865-8a71-e7b9f2304666", "comment": "Malware payload (Viking)", "value": "c68b5f37d9575f5b86e4bc733616206b2acf2655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184526, "uuid": "efcc7d03-132e-444d-a3eb-24a3963b22bc", "comment": "Malware payload (Viking)", "value": "8176ce68099fbdb4f810b6816eaea6c2284c144185f675eb355f3865eabcbb8bc01c4ec5b3a0b784d12ac1dc7b891728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184526, "uuid": "ec1bac59-f12d-4f0d-a4bd-0f2c4a7a3fe6", "value": "T10335AD1B6FFE48E1E486413554A70FE2A5F4AC21BA21C74AC3B0756EEDF4390F90CA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184526, "uuid": "8bf80e7e-a5c5-4a7e-93bf-ab606f3e00aa", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184526, "uuid": "6b5bf6d5-7784-4317-ab5a-6ee62573e4a5", "value": "12288:SjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjii:JuuuuuuuuuuuuuuuuuuuuuuuuuuuuuQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774184526, "uuid": "9f84bd0a-9e88-4149-9dd1-d1e27eae89c2", "value": 1079930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774184526, "uuid": "43e04aa7-81fa-438d-9846-47da143e2061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184526, "uuid": "c87c5891-d2f1-41b7-8eaf-3d3d914bb168", "value": "5a2a9f705ffcb1f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48414c3-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161119, "uuid": "b99f3c8d-2691-4f7d-94f0-44fb725ad053", "comment": "Malware payload (Berbew)", "value": "f28c7de1a8b1268341c7b1f8f25c3ea0", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161119, "uuid": "2da31507-b042-4966-bbfa-8d66db39755a", "comment": "Malware payload (Berbew)", "value": "5a3530d0e9be0ef502061f46559fdc0fce856543ee9f0f154595e5ad70681f0f", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161119, "uuid": "8e983d6d-93da-4a71-a6b0-d02a45cb8032", "comment": "Malware payload (Berbew)", "value": "fb4772a788ec0e5ce238badb05fa015946f0c298", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161119, "uuid": "e2f4579c-f974-4b7e-8bb1-39264c85a51c", "comment": "Malware payload (Berbew)", "value": "0fe4a0991a4b066ed006af394669075d45ccbbaa5c8c6a02efc4024cb109c580e977512d8d2a5e38dcb7440e5ec047ef", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161119, "uuid": "f7053e8f-7922-4e38-b75e-7f958086657b", "value": "T1A5147051BFF9C9E5E2AE87323C758B9825F3FAA5ED55D21B3098032F1DB42408E51A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161119, "uuid": "95b70694-ece5-4413-8aba-1d039c09e968", "value": "62ec3dce1eba1b68f6a4511bb09f8c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161119, "uuid": "ef8ace96-cd1f-45e1-844e-c34d051f6281", "value": "3072:cEZ0dL8+NsouCR5jPFv+Y4H1vkF3VOMC4uMhZpMdoVBRDI+Vvlg3vGp:cUuLPsdujPF+Jk/4AcgHuvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161119, "uuid": "840ca978-b0c6-4cdc-8788-482a4825914a", "value": 190522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161119, "uuid": "c06d300f-d658-4d4d-9200-24374cae5862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161119, "uuid": "3215e98c-753d-4e1e-9d75-c4539f24f83d", "value": "virussign.com_f28c7de1a8b1268341c7b1f8f25c3ea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45693650-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.PHPNuke)", "timestamp": 1774160879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160879, "uuid": "0d29c20d-8405-42d7-a851-96b5ef0de52c", "comment": "Malware payload (Adware.PHPNuke)", "value": "acbfeb5535d4dfd7f842d6b480714120", "object_relation": "md5", "Tag": [ { "name": "Adware.PHPNuke", "colour": "#51B574", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160879, "uuid": "022556ff-f7fb-452e-956f-ce1a00e2c83c", "comment": "Malware payload (Adware.PHPNuke)", "value": "5a4306a96bc4050d7bb326b480638d2be9fba285a03a5ee27ed6eaca18087c13", "object_relation": "sha256", "Tag": [ { "name": "Adware.PHPNuke", "colour": "#51B574", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160879, "uuid": "d0748517-4e6e-441a-92b6-842b7936914c", "comment": "Malware payload (Adware.PHPNuke)", "value": "0674f307c681354a09e00bc065444bb00507fd98", "object_relation": "sha1", "Tag": [ { "name": "Adware.PHPNuke", "colour": "#51B574", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160879, "uuid": "185398d3-446f-4bb1-840b-e4884639dbee", "comment": "Malware payload (Adware.PHPNuke)", "value": "28e580f0b0c191d0526849ef3513ab99b73ee4dc8a0ff3fa65c7dd6e9d170981d42339d0c8c723479bc78ffec9532528", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.PHPNuke", "colour": "#51B574", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160879, "uuid": "5a5be3b5-3c4d-4c49-85e9-3d2522b1301a", "value": "T12C96335331F09953FC9EEEF4E6801EEC6633BFDA17730A122BAC165A39786904562734", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160879, "uuid": "0f788d8e-9ba3-460e-8869-3e1915b90d6a", "value": "97a897e03b5d5c5c772b724098c91197", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160879, "uuid": "68200258-b00c-4620-8876-59a7bccf1f77", "value": "196608:sZjFoKWbsnwAy9b+0tbFKVhpPh+anfM2T/BMzWBFh:AqAwAy99txKVLZ++kTWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160879, "uuid": "548ccc6e-1290-4e94-af00-186d4096d63c", "value": 9182172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160879, "uuid": "77f5e9c9-1dec-4f78-86a6-50ceef0f5dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160879, "uuid": "9fa8007d-cbe3-42c4-b74e-b8ea4b0549e0", "value": "virussign.com_acbfeb5535d4dfd7f842d6b480714120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e239e495-2625-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774207957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207957, "uuid": "253361d9-83a0-47a2-b2a7-55b9ec062dce", "comment": "Malware payload", "value": "b3d395393eba629f1d78184850f49753", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207957, "uuid": "a589b00c-8811-47cc-8516-5ea94b889e2d", "comment": "Malware payload", "value": "5c852fd7458957b89d9b639c6cdede1dc9ab72c384661c4ebc0b3d201344133c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207957, "uuid": "f65f1163-fb26-4ee4-9c29-b942683d428e", "comment": "Malware payload", "value": "6c03893993a96b9be55a7406fe00f39e8d5012c5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207957, "uuid": "f84c34b2-7142-41e0-afb1-d255f2da8425", "comment": "Malware payload", "value": "14a22910996eee682710f2c85db2768d29149180b4984df1dbacf3828058f4745d8a288b262b31eb8308e30d8ff6fdbc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207957, "uuid": "b14d45c7-0a2c-473d-9cb4-8d722d779a35", "value": "T17065010B3F46AE41F729D67F11EBE22CF7F4E980D2A0C04FA990A08145B69B5957F874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207957, "uuid": "9a2984c4-9fc8-40b5-959c-87a51b6eff86", "value": "24576:/Ccq36ccsrS/bBbBkYLPcip7n03MBahvc8BXLvhDV2DOsdOVrhY:qcq36c7S/bRBkkhI3MBodVFZhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774207957, "uuid": "df12fadd-7c8b-4d3c-976d-9658da09d390", "value": 1525650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774207957, "uuid": "cb854893-1f45-455e-9998-e13ed125ec59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207957, "uuid": "afc0c5d1-513d-4c6c-a5ee-818a011cbebd", "value": "DANGER v1 MADE BY PbCat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecf886a-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160760, "uuid": "3b0af05f-cba8-4c5d-9fd6-b98d52d81558", "comment": "Malware payload (KawaiiUnicorn)", "value": "72df5dbc0e733d73e8ec4f74530b6ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160760, "uuid": "86462e65-c3d2-4df4-bace-17bc5840fc56", "comment": "Malware payload (KawaiiUnicorn)", "value": "5db2d6caaa49df772d3be3c69ed471edd1cfcc7ef5d37ab88f491c54bb754977", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160760, "uuid": "48d487fd-da42-4a73-9026-56cebfed7d5d", "comment": "Malware payload (KawaiiUnicorn)", "value": "0c175a5176b356d269fe500f5898ac3d701623b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160760, "uuid": "7b60a836-3390-4d96-beb5-92fe55fb3e0e", "comment": "Malware payload (KawaiiUnicorn)", "value": "45f83246c3f535a231655e5ddbb9f5231f6faa6923e4cc42eaf96482954a601292a89c2a155008bcf1b052db83b10346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160760, "uuid": "56e441a9-9f34-4e97-99ad-dbffb0be2f14", "value": "T1DCA494929C64AF45FE16453427956EBA004E7D2F66E4422C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160760, "uuid": "43439248-d954-4efb-84bd-a2976bc8921b", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160760, "uuid": "fc294f44-62e1-47fb-97b8-16f67257c907", "value": "3072:obTzotmNBG8t2bYNPabcvf8/iCKJXepYiJHx6odtoab+ewJka2lZ:obfoIHt2mPIcvffOZ3oa6zJka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160760, "uuid": "054a451d-14c4-454a-b9cd-d2f4ec3e7196", "value": 479272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160760, "uuid": "4752686a-2ddf-46b6-8c81-ef61c47f21a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160760, "uuid": "952c807f-2e71-4e97-815f-6e2fa1653583", "value": "virussign.com_72df5dbc0e733d73e8ec4f74530b6ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a35184-25c7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774167318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774167318, "uuid": "8b13d517-a2b6-4147-865e-a3ed510b059d", "comment": "Malware payload (ValleyRAT)", "value": "f13695675e5ae4cc1eca73ab7c38703f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774167318, "uuid": "fd2b822c-d9d3-41b0-89e2-a138fa8d34a8", "comment": "Malware payload (ValleyRAT)", "value": "5de69288c38d0d190094ec639c1942a2fc5a902893c6e2fc04a47b9e786d6c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774167318, "uuid": "ed006b45-bacb-4f38-a9b3-e7bb877b94ac", "comment": "Malware payload (ValleyRAT)", "value": "223cd80033bcd17a4e8fa81e9b49c10a990926b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774167318, "uuid": "e79b7279-b983-46cc-9a0f-60ba6d5f198e", "comment": "Malware payload (ValleyRAT)", "value": "f2452394edf43ced85b02d769d1d4aa6f3f2a2d9c1fbc239b0b16c2c4e763089995c970e8c4a7a359fa38304460fe850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774167318, "uuid": "032f1954-d9c3-473d-86b3-b16f9fb39629", "value": "T11A74E40762EC3CE6D8368278AB7747C1E72EFC1542A1D66F02D046969E3F193792A7D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774167318, "uuid": "9394af24-7212-4f32-8911-b7cb4e130b15", "value": "c3c9cb9f889c67871a47ff4250a89c0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774167318, "uuid": "49fad325-1fb2-4ffd-a080-646fd290786f", "value": "3072:hrYAz6joW+tC8nOMrR1FHUla0gCDaDHQ+l2H2AJogFd64Ziy57SFoY46hFPOrWNM:mEWiCOXrRf0A0xD+HQ+lMe/4Sohsbzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774167318, "uuid": "5cb8f3ee-0c34-48a8-a59d-1b21e484fd0b", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774167318, "uuid": "4900e760-5478-42b0-8909-1be8fb2ebf44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774167318, "uuid": "8306268d-3b11-4e6c-8c0a-4fe0ae4727a6", "value": "5de69288c38d0d190094ec639c1942a2fc5a902893c6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08216066-25f2-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774185687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185687, "uuid": "a467dc45-0871-4938-99b5-6deddb9b2bed", "comment": "Malware payload (FlyAgent)", "value": "afe3035221f5d1fe54f60b85a1db097b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185687, "uuid": "424acbf1-e1ee-4ea7-abda-ccdb67cfab08", "comment": "Malware payload (FlyAgent)", "value": "5e1f3a3caf82f619ce678bf6ee8d45d713418641a5c53845113ca9f8c6fa09af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185687, "uuid": "0aa6b62f-16ef-4a18-a1c1-b3cbe1ca19c5", "comment": "Malware payload (FlyAgent)", "value": "28485de6242e34cc3de0fb7ea10c47defe7f4fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185687, "uuid": "bd6b768a-8d63-4d65-acb5-afdceae963da", "comment": "Malware payload (FlyAgent)", "value": "99cfcaba7947c8e289ce5e13a6062c3832ae1cb554ba2b22f1440a3e8d369df66e0cbde56857e01d45e10b56278c6fef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185687, "uuid": "3638dc8f-118c-4518-b917-3d5caf4d0f56", "value": "T18E557C13F692C0F1E61C227124FB6339BE3497450A71CACBEB95DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185687, "uuid": "cd9406e0-a9f4-4440-9b2e-72e521b2db26", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185687, "uuid": "591d73bc-8ad9-4272-9c19-d1fe5fc304a7", "value": "24576:JBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qo7iu5:JZaClSFlG4ZM7QoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185687, "uuid": "8e8f09dd-0053-4304-a62e-3908f8517020", "value": 1375232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185687, "uuid": "6092837d-4288-466d-a237-b2c49cc89a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185687, "uuid": "cfaea7b3-f683-403d-970d-ce6dee50ec0a", "value": "5e1f3a3caf82f619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9634544-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Vilsel)", "timestamp": 1774160671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160671, "uuid": "fadf6eef-72c1-4fdb-ac8a-981bacc160cf", "comment": "Malware payload (Vilsel)", "value": "2d98b64c6af8157e2d7388e19fdbdd90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vilsel", "colour": "#90291C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160671, "uuid": "c7135a41-f641-4318-9e07-4a6392a58245", "comment": "Malware payload (Vilsel)", "value": "5ed5c489debe7fa5ab1d2ac6ef325d8e04c6eba4d2e7b9352978fc046d6d0a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vilsel", "colour": "#90291C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160671, "uuid": "66cb7545-1abe-4a8c-9ef2-b43e563e6046", "comment": "Malware payload (Vilsel)", "value": "c3152ccb655b46c07f9343c25337e40e60c22ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vilsel", "colour": "#90291C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160671, "uuid": "5f3ffb52-30e7-479a-b9c5-5b1aab3cde6c", "comment": "Malware payload (Vilsel)", "value": "064876278b70ff76b00a14d0f98e144eb3ccb41530f7ac1bdb8846ac77ad653652c010f2a6fb07b1bf81dc3268533a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vilsel", "colour": "#90291C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160671, "uuid": "354b71c3-951d-4fb4-b6cf-dad4153d37bd", "value": "T13EC34B1FB3460772D2C103B2360B99D6B71A9D79232A8A90546CF12E2377E7C93B7791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160671, "uuid": "f7e85055-706c-4956-a31c-f607b9cb10c0", "value": "672cea158ad09bbe247deb3d913b4d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160671, "uuid": "0b28c3e3-6b03-4a44-baf0-52d2f4870345", "value": "1536:lvm1Fu8AjYaFwjRUdW7fmyY7aZYJVmy0KQbj6vbjuKoauGi4S:6u8ANCUdgfmD7zey0KUj6TjR9i4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160671, "uuid": "d5e15b20-d3f6-4fad-9703-2649feb3b27d", "value": 125616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160671, "uuid": "edb30213-bb3c-4933-a09f-b884fc5a7a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160671, "uuid": "50a71b6c-facd-4938-a3e2-ffb0838c8153", "value": "virussign.com_2d98b64c6af8157e2d7388e19fdbdd90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3edcf7b-25e3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774179586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179586, "uuid": "ce1c9e0e-3213-4c10-b557-fee8d18ba883", "comment": "Malware payload (AsyncRAT)", "value": "919c1a66b399b53d8763f9610051ec26", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179586, "uuid": "e708e825-3aa0-4115-a37b-eeb4ea04e572", "comment": "Malware payload (AsyncRAT)", "value": "5fa420c354822bc5427af0e7cb38d5bbae10610f71c26c7a53c2aa0ba036b71d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179586, "uuid": "e304c8ac-7ff6-4196-8f93-b7c4a871b5cf", "comment": "Malware payload (AsyncRAT)", "value": "28c606db33f644c24dd2eb14da9aa62a03c43739", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179586, "uuid": "b6bbe2fd-5913-4365-bf9b-0507e9a3408b", "comment": "Malware payload (AsyncRAT)", "value": "c84fcaa7ed5b92cf865ef9214a91700ed05fd26310a096c4ce330bf3eb4dd6f1dcd2005afbd1bde4ac3875e9cdcdad0c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179586, "uuid": "b05e2767-efd5-4d20-9c0c-cd8256da4a24", "value": "T141F26B0977E04326D6EEAFF069B372014674E5179813EF5E0CC4899B6F67BC08A513EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179586, "uuid": "058f898e-a852-4597-9c3a-1da0b5ae3a33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179586, "uuid": "edebc8db-4ebd-4d2a-ad29-1876aaec3930", "value": "384:jNq1q6y74mir6kZvCctmAVz9gkdXzLKNR0d6lL4gJEUFzHd5ApkFyHBLTnOZwpGh:5V45/1F/KN+S4FOddFyZ9FHOjhtSlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774179586, "uuid": "13ce47f6-e8b7-4d1a-ac43-727ef35b3408", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774179586, "uuid": "8dcdaacc-de38-4236-97c0-e8232538463e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179586, "uuid": "41455881-9202-45b0-ab21-23f7da8f0253", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7a494f-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160887, "uuid": "fef1068b-0a51-4f9a-8e22-a8ecd64412ea", "comment": "Malware payload", "value": "adc30d2c40d9f1137016dd207f1232a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160887, "uuid": "5dbb22e8-0500-4cca-8943-34ea5f3a5d47", "comment": "Malware payload", "value": "647085fbac65f6c32b259d8afa83cbfc68b6b8bc6f6e1e01af21e1bf99edbfea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160887, "uuid": "1843a3ec-d7c6-4792-962e-3ecf8441a204", "comment": "Malware payload", "value": "24d9c5f92cc6a6e5eb3731bca4e2a7c120727b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160887, "uuid": "903f07fd-8941-4b91-9cca-3f2105879c45", "comment": "Malware payload", "value": "ff1365a1f3eb720caa8fcfa4618dd8885b3aa95f190e4788f18c33294f81f99df8a6b3999737f1ba1a4208235d1dd016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160887, "uuid": "c4f6d5fc-1ce9-40fc-a9ab-c5b5055ec950", "value": "T105A5E7A0EEEF00F4EA075870D55B623F5230270A5738DDDBC6941E83E627AF25937926", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160887, "uuid": "e921ca65-b0f9-47e0-9fec-3ced8653b3b7", "value": "24576:vBF672l6i2Ncb2ygupgrnACAmZ/NwFC31G3AcMxA7DELKcW7wpebBQLn2IBP3WK0:r56uL3pgrCEdMKPFotsgEBr6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160887, "uuid": "b8b6d9c4-cba6-44bc-bea8-a915f4409b69", "value": 2105067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160887, "uuid": "541be04e-ea47-42f3-b59d-7d8623384469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160887, "uuid": "4f5976fe-05a6-4a40-b597-330c96a94243", "value": "virussign.com_adc30d2c40d9f1137016dd207f1232a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e89bc1f-25e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774179846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179846, "uuid": "87b57167-a5a0-4b72-80ea-0d3ad8e909ea", "comment": "Malware payload", "value": "a051282cb1adcf89c090e28fc5a10af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSILZilla", "colour": "#D377E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179846, "uuid": "bfd8b253-0a2f-49ab-9a1d-61429afc35bf", "comment": "Malware payload", "value": "6502945d90d75d7c45c117312ec4682d2baf1eff10ae3382a3517c76ae17c271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSILZilla", "colour": "#D377E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179846, "uuid": "4629177b-016f-449c-b61d-a9eb579876bf", "comment": "Malware payload", "value": "ff51bf9726c275bed407c9d4cf7e606592cc8bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSILZilla", "colour": "#D377E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179846, "uuid": "0469dfc9-d571-4b1c-83e1-f68cdf97bfde", "comment": "Malware payload", "value": "10213d18d1ecf70915597cce054104fee204a4bb17e5a451c92171fd2787e2470aaa1f146b52acafb5c970962b62cbc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSILZilla", "colour": "#D377E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179846, "uuid": "5340e59d-b39c-4de7-9e29-0c826e7b4259", "value": "T1AED66B1021D86607FD7ADFBE89DC76440F7AB2913722FE389B4109ED4ED1B59CA025A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179846, "uuid": "de6adcea-f49d-4f3a-80cd-969f2dc0c836", "value": "196608:cpyJLQM2UKoYM9PWnlnEN2MOGWz8E7nhKTirMlsxvi0r4xwmh1uVvIDcf:32U1Y96/Wb4irJvi1xwS0gDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774179846, "uuid": "be45faec-f9f2-4028-88e1-f02fbb1fa9b5", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774179846, "uuid": "5638005f-23f8-4d8a-9a04-6b101e81d744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179846, "uuid": "3b54031b-45a8-4bbc-94ce-b74f4a337563", "value": "catch5411.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea66c71-25bf-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774163847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774163847, "uuid": "18976988-7431-4026-949e-970f6caeecef", "comment": "Malware payload (RustyStealer)", "value": "2a2c7a3950baa322bf9c891ff3eca080", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774163847, "uuid": "95dc5b6a-5527-44c9-9cbe-ca14b0cb95dc", "comment": "Malware payload (RustyStealer)", "value": "656c6585eed987efb12836b59447f9fce7dc4399f63c95427c05fbff3cb52bba", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774163847, "uuid": "8735feac-ea2f-4d07-be23-6977d9b38875", "comment": "Malware payload (RustyStealer)", "value": "d61659a98003a93a8d91fea3a2404b6137f21f02", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774163847, "uuid": "d8578110-5697-4192-9617-ab8223e93b2c", "comment": "Malware payload (RustyStealer)", "value": "252f6b2179ca12135b955cf114d0e9428df11b3bd1f6cec881d4577c9b24495203d3b0b8d3f6063089c6d52a06538a9d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774163847, "uuid": "ba8bd18e-214f-4583-b8b1-4d574a5eeab1", "value": "T186D67B2020D86607FD7ADFBD99DC76540F7AB2913722FE289B4109ED4FD1B49CA025A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774163847, "uuid": "a9330b71-e316-4c5f-a422-def3cfa57ee4", "value": "196608:zpCpVyO2kBFPNGENsNI1jb/XwWsqpesqT+L0H+sP5/fpHjpm1a:xO2xENswRR8dS0PP55HVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774163847, "uuid": "59844aa5-bcf0-4854-bf0e-5599d8c376f8", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774163847, "uuid": "fc70b370-498e-450d-ab2d-a68bd43b9886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774163847, "uuid": "a9e18777-a4fa-49ec-8b9d-58d78c2ea742", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115024c9-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160791, "uuid": "ce68aca0-f4b9-45fe-a892-a7509f296603", "comment": "Malware payload (KawaiiUnicorn)", "value": "85041dbc0d3a6f9039c30b0f8822ec90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160791, "uuid": "054f36db-ee25-43c3-9adb-c6509e2c9ff4", "comment": "Malware payload (KawaiiUnicorn)", "value": "664a76eb612a7ad38b83c9aee1a1283f4049c9fcf83bd79ac9b849b4e322ae17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160791, "uuid": "bf04231f-5be6-44ec-92a6-fb6e11d001db", "comment": "Malware payload (KawaiiUnicorn)", "value": "8cf99ae7177e03e53beee2dba8e8e5f4d21853bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160791, "uuid": "867c6bd4-a4a9-42a4-b801-fef8c2718874", "comment": "Malware payload (KawaiiUnicorn)", "value": "4ff8c8cb561178769771cc792d27a611c07ba194ebb570a055efa45b3be07e7cf9bc1e8830d586f375ec3f7bf56f5aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160791, "uuid": "355d0d5c-8e10-4844-8381-1b02a48e5321", "value": "T162A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160791, "uuid": "dc8289c7-4780-4c85-b47f-9600f85ec79b", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160791, "uuid": "e8955a1a-7d2b-4bac-bdae-03d8129c4746", "value": "3072:W/R+ogK/05932lYN7PrjEqf8/WKDHDuuipc8A1NIAfTJhngYTLVj:W/goIj32EPfEqf6C7JAftZgYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160791, "uuid": "eabee196-8844-4049-b0a1-647f037d2cad", "value": 479247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160791, "uuid": "e461b75e-70a9-4f0f-8618-5318b3864d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160791, "uuid": "8c842456-6782-4691-8472-4bd759d6bd24", "value": "virussign.com_85041dbc0d3a6f9039c30b0f8822ec90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ef5b11-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160846, "uuid": "76a161bd-fe86-4d68-9296-bd3ff0b086c8", "comment": "Malware payload", "value": "a9b596fe171705053b2ebedc5b90a860", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160846, "uuid": "e675bafe-7166-4426-a365-4db3f564ada8", "comment": "Malware payload", "value": "67d46c79cdd741bdff0446b1674035589023f82e1cbd6bb1666521ab1bd8b0cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160846, "uuid": "1b28b21c-f8f6-4efd-9824-c692b80a4caf", "comment": "Malware payload", "value": "33bd26336f414978cf0e672ae41eade3cd09f465", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160846, "uuid": "22932d91-cc48-45b6-a187-69ef68c31d40", "comment": "Malware payload", "value": "1511cc71dd0add81c6e61359d6f2e835390eeb37c848453c4d1b9468292cdc29a1e345fb02f8048c8882a469085c6bc5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160846, "uuid": "d6605209-b7cb-4c8d-b32e-30f6344f59c1", "value": "T11B63F19733440395DB9256B9038245B241BED741BBBFCB117D2DEA0098ED7F79A9C098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160846, "uuid": "48347530-3105-4f6b-85ea-7d4038a609e0", "value": "84c1185cfe9411343fe287d56d637373", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160846, "uuid": "85b488f0-1dcb-48c6-8b6b-a8fe8a5ea73c", "value": "1536:HahVVNDN65GS+x/iPGIBG6ML0qEutdqJ8nF:6h6Gfx/iPTdML0qEERF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160846, "uuid": "a86a6d9e-f1c8-460c-b161-851c79eaa4f7", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160846, "uuid": "b75d0a62-c584-4248-a401-a31a8aba62ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160846, "uuid": "5edff352-f0dd-4845-a06f-430eba82be96", "value": "virussign.com_a9b596fe171705053b2ebedc5b90a860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52b914b-25e4-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1774179991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179991, "uuid": "a4357c45-a5d8-42e7-9bc4-2a8cdc0fb2f7", "comment": "Malware payload (BlankGrabber)", "value": "9109f4709b3786a1e5996ca2e98db8f5", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179991, "uuid": "744683ad-54b3-4971-9b21-673fbbb54ba8", "comment": "Malware payload (BlankGrabber)", "value": "698c82d784f9d2a7b206b02874a825d7f939e718fb139f865bf3ef6f976acbb7", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179991, "uuid": "0e9edd47-5064-421e-a76a-3d26706ca7af", "comment": "Malware payload (BlankGrabber)", "value": "9e31bc280c4b5abab5d8a4e54addfb0bafb2e11c", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179991, "uuid": "f13400f4-7120-4737-af6f-4ddc5f8e1fc7", "comment": "Malware payload (BlankGrabber)", "value": "729a0e5b3871d90e054a5ceab2513219148d278b95fb5b4591c38591a025850a394345020a08c1a9b51a3c1e76caa56b", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179991, "uuid": "6d23827b-28eb-4bba-b3fa-3e24d41c8cdf", "value": "T171B63304A2A909A2ED63613D8713CC9AEF77B8456F50C9CF27AD62162F1FCC5483A774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179991, "uuid": "f76dd8ef-dcd4-4bd8-93f7-bd871f30ef28", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179991, "uuid": "6668ea30-d73d-46fe-a2d1-7cd29df2f095", "value": "196608:WKSdL7pLjv+bhqNVoBPD7fEXEoYbXIv9Tne2XkMknLt4tUrB0dYMQKct:WKIxL+9qz8PD7fEUbXIhc1LiYB0d9ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774179991, "uuid": "36a620f1-ff72-4404-b92c-90c24d6feca3", "value": 10996025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774179991, "uuid": "9689171c-0b7e-424c-be95-939391131a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179991, "uuid": "65e4c0c1-0ea1-4f37-b197-7c04335cdc5a", "value": "EnrollComServer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d969c147-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774161127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161127, "uuid": "91c5a302-f323-4cfd-9832-c0546e7997c7", "comment": "Malware payload (KawaiiUnicorn)", "value": "f53cf565baf090c80f708f0b2433ea40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161127, "uuid": "a903f1e0-958c-4e36-a6a2-c19aa2708542", "comment": "Malware payload (KawaiiUnicorn)", "value": "6b28c43c1812482c46e8b7981a530051cf71f0e6baa623e61665bf43ef9bc2dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161127, "uuid": "6500b4b4-a70d-41f5-ad3c-84b653a67ce0", "comment": "Malware payload (KawaiiUnicorn)", "value": "6bc301c321a272a56b861c4f72182d3294c3e7e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161127, "uuid": "e8f15e37-a797-48fe-b1c0-aba2daeaf137", "comment": "Malware payload (KawaiiUnicorn)", "value": "1306d1ca9296d39eaf2f0007e635d4edf0259415bebc7e349ecdaf473b07fe5d88d5cd0b896b6acb4f9b5381cff00c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161127, "uuid": "bea3468a-2be1-4cb0-bac3-b22783d7ed38", "value": "T192A494929C64AF45FE16453427956EBA004E7D2FA6E4422C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161127, "uuid": "f6655fcf-3ee2-41a6-a8ab-dc4749153eab", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161127, "uuid": "7d513db0-60c1-48b2-98fb-500581e012fe", "value": "3072:5oZ5o+6gertw5CYVP7lj3zDS5VXBLIgsumHeF3AHx+SghXWfPol4:5oDonxw5VPBj3zsdXQx+XlWfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161127, "uuid": "429d73ff-b1eb-40bf-8dbb-5972a4407ff3", "value": 479794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161127, "uuid": "a5f630f0-1d0e-4044-a2ce-6fa53992643f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161127, "uuid": "09abbc1f-70df-4f21-adec-c0b547156852", "value": "virussign.com_f53cf565baf090c80f708f0b2433ea40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453f3216-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208982, "uuid": "4c9e1b54-d847-49bc-97b1-975f181bb5bd", "comment": "Malware payload (Mirai)", "value": "d5a5e8f7574825e722b3caca4b0395e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208982, "uuid": "416d8c22-f607-4bee-abca-023d95295982", "comment": "Malware payload (Mirai)", "value": "6ba5c3ac96539322332397adecb18cbace6f57ae9cfd509bb3600c7ead29d319", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208982, "uuid": "843693bd-dfa5-4edd-9ed4-9fb1da33f3ea", "comment": "Malware payload (Mirai)", "value": "1ea4bd39c52690fbc35d7d0d751439ff295c7f4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208982, "uuid": "18733e97-1377-4963-ab81-3d1f29b923d1", "comment": "Malware payload (Mirai)", "value": "ec678cc5e43c2c054045ae1125ff164118ad2de02ef316cf9d4ae49273e684c4d5acefd167ebed917e1fd205a053042d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208982, "uuid": "18db44a8-3b14-4383-9116-7f0797e96a82", "value": "T1CD143A46EB404B13C5C6177AEAAF42453323D768D3EB73069928ABF43F8375E0E66506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208982, "uuid": "208bead5-164d-4aa8-82ea-8a88b6b855a1", "value": "6144:AwnSEIia6WyGRs9YtGDS1RaXX0L/Ks/cXO+:Aw0iaLyGRs9YtqMQm/V/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208982, "uuid": "87596a70-e5ca-4ee4-876d-c4caa5be794a", "value": 205750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208982, "uuid": "3865ecd3-dbe8-4ef7-9cf4-0d03e081b32f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208982, "uuid": "850b428c-202a-4ebc-93aa-0ba5a88e70e1", "value": "tux.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01cac87-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774160655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160655, "uuid": "9f601101-8e46-493c-819b-9f2b785407de", "comment": "Malware payload (Snojan)", "value": "1f9db0e9196f95a36cc7c6ffb3f32140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160655, "uuid": "ee540d6b-c5b7-4e49-bb9c-76b6549f9624", "comment": "Malware payload (Snojan)", "value": "6c3d889d004469be888abc69b2abc3e30ae1933f86b5eb0df840d9ce55eca434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160655, "uuid": "f5795455-3d11-4683-9821-097c2cafa7ea", "comment": "Malware payload (Snojan)", "value": "c01ff9923507703b8cc0d078b1d0e61f0f4a2208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160655, "uuid": "de603402-464f-4ea3-9adc-436ae91592fe", "comment": "Malware payload (Snojan)", "value": "f0775b2d882502e6db48c9e88610aa9e3379e071023d80dd896441648cffa21dfebcd91f7f0e203ce8500e2362f793a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160655, "uuid": "6ea013fc-2824-4271-908a-19825c934e4c", "value": "T17C345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160655, "uuid": "221272a8-ad8e-4921-b265-2ed6c2ef62e8", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160655, "uuid": "f77416d4-392f-4c6e-a200-e97259edba39", "value": "3072:tJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/o/FnncroP9:XwDeM7iNEkgiOb31k1ECWJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160655, "uuid": "6e17fb82-769b-4129-9bdb-7bc698a30dcc", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160655, "uuid": "7536dd69-9d34-40be-8030-0013f4ccc325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160655, "uuid": "236e47cd-8a03-4e19-b955-c445d8b64808", "value": "virussign.com_1f9db0e9196f95a36cc7c6ffb3f32140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b16711b-25cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774170740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774170740, "uuid": "d5edcc02-dcef-450a-b848-20c6882f654c", "comment": "Malware payload", "value": "aefaf428995a1e0481f4b550203a2622", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774170740, "uuid": "4304f8ad-727b-44a7-85c2-3f2c2006f542", "comment": "Malware payload", "value": "6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774170740, "uuid": "3c6f28c6-def7-4956-b3af-5c7a0f04f0c1", "comment": "Malware payload", "value": "136b362d3ee42cd3d1f18a1a26b5c8d85f8cc02f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774170740, "uuid": "c9be754e-8400-45ce-b609-74f3f61e018a", "comment": "Malware payload", "value": "98a3fa191cdce52e4ff3b19f3d914e735aa650fc0cde1cff496d3278cea8a345bdca225af684556ade5df5b5bb67e2f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774170740, "uuid": "e8fc1e15-9920-4af2-9f43-9a1c0a965a95", "value": "T1BE925DB512496C79FBD1CE39AF3C6F4DADE8C2C42124A3ACBA4F39215A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774170740, "uuid": "24e9ae35-6e81-4358-bb2c-220b42e8b59b", "value": "384:qFcuQpWx+BL0SWL0g6zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:qF8i+BL0SI0FzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774170740, "uuid": "c2de2707-f6d1-474f-9a75-2a31ccf7bc41", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774170740, "uuid": "d1b74bb5-794d-4388-8742-9d1ce935a74c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774170740, "uuid": "53cdb679-5043-41b0-a685-352a89271ca1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3879bf-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774160976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160976, "uuid": "049ac23d-3abb-4484-a7f6-7278a17eea28", "comment": "Malware payload (Berbew)", "value": "c33d5f17087ce264191f92528a436b10", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160976, "uuid": "1b3c25d0-1896-4bd5-ae86-b87aac34e191", "comment": "Malware payload (Berbew)", "value": "6d399b5364c10cf909cb7d1efd3b7e6caff8c0ac3be1696e92b2680157449e51", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160976, "uuid": "4e9a9ff0-2311-4177-9f6c-7b41542b7b21", "comment": "Malware payload (Berbew)", "value": "f4a1419514de72ebc1287c9cb204d2a2b8b3118c", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160976, "uuid": "920fbe1a-3408-4070-98f9-cea880102d4e", "comment": "Malware payload (Berbew)", "value": "572a3a514bcf8bbe6a7a841fcc93cfaa5ac725892202d009c8273ab03ea66d429b74fc1eeb5c0a1a5a8f3eb1b86e2434", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160976, "uuid": "cedb9a6c-33bd-4a23-b34e-f6b6b393ba7c", "value": "T144938E37A5784FBEEDC0C772320AA866B73411F002A665A277D574AF11F7D48C6ABC50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160976, "uuid": "0f27da1f-a207-4dff-a864-66ddd271e67e", "value": "0f268c0d50a68cd5b512b62a84e2774d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160976, "uuid": "3cfee41c-42dc-4c58-8c7a-11fdeef5b80e", "value": "1536:hLp2+HZLzWajlOA/y4XtO3K8UEPgZdGUa9K+LiXcfOOQ/4BrGTI5Yxj:hdZHZLzWUlXt4UEPgZ8TKXAU/4kT0Yxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160976, "uuid": "1c7657aa-c185-4934-a729-827721d6829e", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160976, "uuid": "a6e7f20c-5f75-4e68-8e5b-c734233fbf08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160976, "uuid": "cfd7a568-ccf0-4b85-b98f-8fc047aa03a1", "value": "virussign.com_c33d5f17087ce264191f92528a436b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d959d29-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774160946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160946, "uuid": "aead8300-c9b1-4e19-8818-57075974aacf", "comment": "Malware payload (Berbew)", "value": "bad664c4c151172236cf28f14f834560", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160946, "uuid": "d078ecea-1493-4077-90bd-4fb771fe977f", "comment": "Malware payload (Berbew)", "value": "6ebcc7d1f53568816b5a0e40d6e5117266a33dfc4a1e75425062a20425b64341", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160946, "uuid": "cda7f83a-c3db-4724-ad7b-7e7b14be4100", "comment": "Malware payload (Berbew)", "value": "bd71dc7ce5d748d18d35ffe278fac6d0c9af9a1c", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160946, "uuid": "f775067d-b7f8-4adc-a9d1-f6ab599a6255", "comment": "Malware payload (Berbew)", "value": "40ce5cb7de06cab7a7242cf60baa708fc5abc78a0354370927228486948cee7e65bb5949acdd7368a93d85355efdde43", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160946, "uuid": "a055ce0d-338f-4925-bf53-120b45f35917", "value": "T1F2C37D6FBB550FB2C39102B2261A49D7FB29B03A2E7D95A71464D07D1217F7C82BB281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160946, "uuid": "6fd1b3db-500a-4991-8110-56b9c8c820c0", "value": "8a8b2bfe372245efb9b3eb8b5be010ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160946, "uuid": "d3e380ba-4414-4171-b63b-9ed21f0b6a17", "value": "3072:v16UddXXW9HAhfxZPqRfiRYSa9rR85DEn5k7r8:v16W5sH+xpCfi4rQD85k/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160946, "uuid": "3c4f04af-7d03-4030-8d65-3567d8eb7836", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160946, "uuid": "38a2c845-4d7a-465d-ad46-9aa787047743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160946, "uuid": "b69fabb3-2556-4546-8aef-ec9ab625dbd6", "value": "virussign.com_bad664c4c151172236cf28f14f834560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f86d43c-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208973, "uuid": "109f8cef-8b08-4505-b229-c177c7bc7696", "comment": "Malware payload (Mirai)", "value": "271f297a188500497afdafca129bf03f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208973, "uuid": "60722b0c-0790-4fcd-aa46-282e397a2bc0", "comment": "Malware payload (Mirai)", "value": "7083d76b20f2e852a32ca482fcc68aee6f0d809872aaf2c9ef55b7c9159e10bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208973, "uuid": "923d7af6-2853-4616-b329-7a06600ef2a5", "comment": "Malware payload (Mirai)", "value": "7ed8b1139cd1a17a8f793f754a64f6e618d46fd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208973, "uuid": "901231d3-4ca5-420b-ab43-5944ba225674", "comment": "Malware payload (Mirai)", "value": "f8e296df5112886bf04de0b869510cc67a36e29758d989d26ff27b855f0b3138e43f08867adfbe28e35298afdfac1dc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208973, "uuid": "4f187466-812d-417f-b8c6-88e0ebb7a9b9", "value": "T197B32A82B9819A22C6C1567BFB5F018D371603F8D3EB32179D285F61778B91B0E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208973, "uuid": "0259c327-2e15-4635-83d8-b1f9c316f99a", "value": "1536:mvyky2REq7CmkwzCrSnW/3+xHEu5bfnhrPJJZqj16KBWHkRE2YJc13uOnQeBwzIp:bkNiq7vBn0gfvFJCjg9kR1YJignU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208973, "uuid": "2b0cbbe8-a7c1-42af-ba56-d8753aa3f296", "value": 107764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208973, "uuid": "5dfb7f95-c329-4fef-9d04-516bccb1609e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208973, "uuid": "ab79e498-c4c7-41a4-8ee4-9b4bf4a09d2e", "value": "tux.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62d9986-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774160719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160719, "uuid": "50c7a705-f5b1-425d-b4e0-5a47608cf185", "comment": "Malware payload (CoinMiner)", "value": "54417b17cd9da2959c0286958a0480e0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160719, "uuid": "6a526b08-a57b-4de3-823d-78d5bec88043", "comment": "Malware payload (CoinMiner)", "value": "740899acaef41bb636a672d5ed50ec80028108f6c0f6ab2bd163a318ce33e3bc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160719, "uuid": "89baf2ab-3296-4a2e-9ed3-5595fdc714c1", "comment": "Malware payload (CoinMiner)", "value": "15511bb7304755e7215d664c1f2bf84634630bd5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160719, "uuid": "0cc6215c-e3e9-49dd-bac2-b574c7d44d1d", "comment": "Malware payload (CoinMiner)", "value": "60cd0661fc9d968ee580fb28be5dc68db45cde9238156d6af99f2143998d3e4666a3ea4ad1553bef81acf2a40bac5982", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160719, "uuid": "ac872f39-f8f5-4def-99f1-daa7bd867257", "value": "T160565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160719, "uuid": "ac37847d-ec2f-412d-ae7b-1c094472c3cb", "value": "c782987849999c5ae345a5deafbd73fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160719, "uuid": "5d79e5d7-ece1-4729-945a-82345a2d65d4", "value": "98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lU1:T+q56utgpPF8u/71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160719, "uuid": "4400707b-d4df-43be-8741-483db2d127dd", "value": 6364583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160719, "uuid": "7dd56385-2b55-48d0-a37d-ae23ecd63e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160719, "uuid": "4d9578e3-c3fa-4250-925d-31bd9c3074b8", "value": "virussign.com_54417b17cd9da2959c0286958a0480e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668b599e-25b4-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774159216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774159216, "uuid": "89f16811-1d26-4e9d-950d-8cd94e35628f", "comment": "Malware payload (QuasarRAT)", "value": "d947b5728a5809bbcdedecdef177d6c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774159216, "uuid": "87a45cea-e17c-4546-9d75-5d5c7246a9eb", "comment": "Malware payload (QuasarRAT)", "value": "75537e068207f7870673698447f8dc9b274e81c7f5ac63ef41f8d41e9c281da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774159216, "uuid": "1bb8f868-020a-4c3e-98b2-f0a559a7919b", "comment": "Malware payload (QuasarRAT)", "value": "0d563b0e48ec3c486e20949c8532ba350da9822a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774159216, "uuid": "f8ba612f-04f9-41dc-bb09-bf287080526c", "comment": "Malware payload (QuasarRAT)", "value": "bd55b907bfab6591360a172a014ab3d147d2c23b95be45f391e4341b4ab9ad18bdcf49e13f816092e17ffb95cb7d82aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774159216, "uuid": "240aa8ac-e66c-48db-b0c5-c0800114035a", "value": "T19D66AD1037E87FE2D07AD272D5B150D266F1FC2AA3E3E78E51817A6A9C7374048436A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774159216, "uuid": "5f10ddb0-3cf3-4125-9c8a-0779dc8b9cd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774159216, "uuid": "ded4abd3-d965-47a1-9ec2-7a0905faab90", "value": "98304:rLSub+JrMGUV1ypiUhM6+iTFv7t2d5aKCuVPzlEmVQ0wvwfbNHYk:r1bIr5e6+2EqwpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774159216, "uuid": "08692ae5-858a-431f-b682-e089327ecd2b", "value": 6909952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774159216, "uuid": "77e7c934-8c25-4510-9752-515876089917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774159216, "uuid": "619f7bea-e562-4f60-a0e5-30f4e97fa534", "value": "x75537e068207f7870673698447f8dc9b274e81c7f5ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab11f0cf-25ef-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774184672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184672, "uuid": "a48bab5c-9a33-45ef-835f-bf87e07f7339", "comment": "Malware payload (FlyAgent)", "value": "e8f7eb704782bfda106c7f5bd5e82e23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184672, "uuid": "dd650e88-643c-4cd5-a8a6-f07ba04ee44e", "comment": "Malware payload (FlyAgent)", "value": "760c768636b63ffd7c8b053298de81f19a8583626e72a3c2eb88b1ae33a9bf0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184672, "uuid": "f1b5426e-f596-4ec1-b6a2-504aff751fe4", "comment": "Malware payload (FlyAgent)", "value": "120787ac936e83897b9b319b1715531f3393c475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184672, "uuid": "5d3862c1-aac3-4994-8ac3-fad1424193bc", "comment": "Malware payload (FlyAgent)", "value": "ec7cd2185515e35c47ad9941178fca1abedf76d4b7eba0512ee0f710e28ebc979bcefa9883750fee47adaccd2208a938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184672, "uuid": "165baf29-7b9d-4dc4-9f31-eac693a0655f", "value": "T10F458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184672, "uuid": "4dd01523-08b8-4f61-b6ac-adf105632133", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184672, "uuid": "8efbd5b4-917e-4c54-a666-48457a6af6bd", "value": "24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qb:acallSllG4ZM7QzMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774184672, "uuid": "50415314-e8c1-4be4-a59b-615a56706af6", "value": 1174403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774184672, "uuid": "02920764-e303-4552-8b72-81eacd60e2e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184672, "uuid": "f478563d-ba87-4692-9703-97a9820c2a1e", "value": "760c768636b63ffd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ca3dec-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160663, "uuid": "f39dd48d-1e19-4fed-99e8-985a818ad782", "comment": "Malware payload", "value": "239b5810cec4143f86f19ffb73da20f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160663, "uuid": "7026e272-90e7-42a4-902d-2084e0aa929c", "comment": "Malware payload", "value": "777fd8479c8f08cdb51a66fd45988472a23eb68ec0b2410c7b7740e9ce32ab6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160663, "uuid": "ae41d728-dc5d-4f1e-82d7-927d32004b3b", "comment": "Malware payload", "value": "86080443f0f74fe12defca5eb1fbc69cd20758f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160663, "uuid": "0b1b908b-32af-4b0d-9719-18484a9a2242", "comment": "Malware payload", "value": "068ac7de92ae6ee9675053e61c5e571ad7d0a47c6ae4764399403f3234e459616bd8c9bc978cd95072296a14a3bd4612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160663, "uuid": "9392b458-3204-4b8b-bb65-4378b47f0503", "value": "T1D4C3AE98B644CAC0ED6A07B04CC2F6580E58FE561DC746A7B4A033AFE97A743B449E70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160663, "uuid": "13dd9caa-6720-4cad-996e-2568771c4e60", "value": "3243b13e562279ab7fbe2f31e45d3a95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160663, "uuid": "0a545412-0686-41a7-9751-a72886d1b73b", "value": "1536:jMLqcuJ1UuXnCzsAKpL5XUWRqtnouy8M4dPpc8S:Jc4SYAKpVRqVoutvPO8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160663, "uuid": "d5580ba7-13af-4bd6-959e-b947d0e4ba40", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160663, "uuid": "45adf62c-910f-46ab-a6af-581b7dd8a82f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160663, "uuid": "e283b57a-6b78-4b0c-8e31-b3b425eb42d7", "value": "virussign.com_239b5810cec4143f86f19ffb73da20f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad19eaf-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160807, "uuid": "3d189ee8-a895-46da-be5f-3d43f77c3897", "comment": "Malware payload (KawaiiUnicorn)", "value": "955c543e1d422dc272d1c5b914ca5480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160807, "uuid": "536d93ec-7acd-4c45-b98a-9c47416a7d25", "comment": "Malware payload (KawaiiUnicorn)", "value": "7d3e3b96d848fe37afcaa7f78e4d02f3a19e74156d93f630fcaa8ac1db933faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160807, "uuid": "3758b63a-4fd1-4685-823e-711da9830157", "comment": "Malware payload (KawaiiUnicorn)", "value": "0b36945555ce5053e784d9bcb71b9356d9674caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160807, "uuid": "90cdd8ed-fad2-4213-8bba-5df239702fe6", "comment": "Malware payload (KawaiiUnicorn)", "value": "3d915dd9a85e503ab3bdf91ebc2e9e1c57b85d08d0c0a9e5c5eaf7ac4f699e08d7c786e08a0351cb27054f91c0733784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160807, "uuid": "bc75aa47-884e-467d-83b8-261bb7321183", "value": "T101A494929C64AF45FE16453427956EBA004E7D2F66E4422C785CFA0B337399B30AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160807, "uuid": "536a5b5f-e262-4b65-a0b8-5a459c3b14d9", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160807, "uuid": "2f154c6b-2e04-44e9-b88f-3c08d5ad101f", "value": "3072:L0XKotFwIj3qtb+lPpcYNfsTrDdQuI6Q71HO3VFNBbi0wTsnXa+2:L06ozzqtwPCYNfO7f5BbbSsnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160807, "uuid": "aefa596e-ecf1-4524-a4fb-2b1f45b4b2f4", "value": 479698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160807, "uuid": "9b8945bd-f830-4771-a7b6-d186db90d705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160807, "uuid": "b681583a-6a96-440b-83a1-5aa528839f57", "value": "virussign.com_955c543e1d422dc272d1c5b914ca5480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24c2286-2636-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774215205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774215205, "uuid": "2ce64550-2cc9-4f20-ac85-b3a0b7bb0aaa", "comment": "Malware payload", "value": "fbf9560cf97672ac89ea82d4b4c1bbde", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774215205, "uuid": "b7cf59f1-da4f-4c69-b5ef-12d2ac311dac", "comment": "Malware payload", "value": "7d52c9de4c43615abf222b7ebc75c5971b10410b5e23d942cf2acd5471076784", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774215205, "uuid": "830c0a72-a5ed-44ee-977b-87e12917f1b9", "comment": "Malware payload", "value": "d8dfe7218d53ef61405890a3190c8fc750429b80", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774215205, "uuid": "9fef5e48-e9eb-493d-a02a-d562069ea6dd", "comment": "Malware payload", "value": "ef1042e7b6894644193a7dbd87631709debdb3d05892ce12b50f16c9c03ec23d453a385d76a37dd626dd4d29a418cf98", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774215205, "uuid": "274e9313-82d9-4f48-9920-a79faf6486d0", "value": "T1F1B395862B8E49E48AEEF81C155FAD0FE7D0E147125DD6C3BB8D80407F31999A1E67E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774215205, "uuid": "49115f48-3a47-4437-9d73-da13b5d4977d", "value": "768:5KBNXDdPRvpbz722c+TzCcBEz98hpB8reu7AnRpMxyyR5aPDUAlwGGZpUtqny7eB:QB5DdPRZz722REqhpB8reuoO8XpMWoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774215205, "uuid": "dbd66655-2f0a-4f6c-9aa4-f9c07543b008", "value": 110744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774215205, "uuid": "7d11fb8b-a4f5-46e8-8dab-90d85b407327", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774215205, "uuid": "0aa9e842-9ff4-4e79-a8aa-febd0754f5d1", "value": "Home_Document_Beta_362.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6903b241-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160939, "uuid": "1e81f379-a2ea-4e93-ba1f-40320e419a1e", "comment": "Malware payload (KawaiiUnicorn)", "value": "b7ddddba6aa7342ebc00216f73a874d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160939, "uuid": "d2051ded-ba06-4bb8-b46e-9899a050f590", "comment": "Malware payload (KawaiiUnicorn)", "value": "7d6cc5ed01295e65a1cd94a35534b7c7b83786e5b4b5436d0804010bb6568c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160939, "uuid": "b08061fb-a013-49fd-a18d-d4a64a46d84a", "comment": "Malware payload (KawaiiUnicorn)", "value": "8e242e24d06d722c9c27076afecd9640139dd201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160939, "uuid": "7bd67bef-6134-47da-b8a0-88f5dfd56700", "comment": "Malware payload (KawaiiUnicorn)", "value": "8c79addf1da84671bf59d7f12918c918035d4ecbb706db6238594c326d7c015867a33d6eac0974516bdf8436864c04bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160939, "uuid": "c921693b-3624-43cb-8ae8-61ffaa3bd2c3", "value": "T106048F628970BB13E951093517E06BFB801D3D2F4BE502097CAEDA5F3763D9A349FA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160939, "uuid": "9ec2b463-f2f7-4ee3-ab11-c1030f911eff", "value": "3072:AEf+5OolqfKLdUfZtxT98ETtElvnqnxiuP:AEZohxUf/8qtElPqnxiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160939, "uuid": "f2daef3a-f02e-4ab1-b6c8-1e8f7a09abba", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160939, "uuid": "3a593c47-7dbb-4668-b12a-d650e641cb4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160939, "uuid": "d12b9359-c92f-42ab-926d-4b56dcba32c5", "value": "virussign.com_b7ddddba6aa7342ebc00216f73a874d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb2ccff-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160569, "uuid": "4aa66827-7ff7-4890-87d1-c69741931dfa", "comment": "Malware payload", "value": "0d0d4bcd65381208f55825b2c4247287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160569, "uuid": "372edbff-2887-4dae-b8df-12fd97c8c717", "comment": "Malware payload", "value": "7d978a454f0f0b60b33069abdadd324d6a7c1a2bf6a1f97390c6de3d11bd9bda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160569, "uuid": "6f010d09-ef36-408b-abbd-b83b196b45d1", "comment": "Malware payload", "value": "c88d94c178a30ed370ed01f0b1d5c0a95814f290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160569, "uuid": "b479ce8f-f91d-49be-b633-892f43412443", "comment": "Malware payload", "value": "1076df81d74c2e59c3070c85d429e37cd99a869ef1b55b6a961c66523d487102cda996809dd9938e2d852e2cdad34f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160569, "uuid": "d1215c03-c1c8-4b75-b34a-fd9f1757e8fb", "value": "T159156C52B3D3C1B2EFA119F2C97457321939BC34933889CBB3D4392DD9A12C16A7935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160569, "uuid": "1e845f7e-8bb0-492a-874c-327c1bd7edf9", "value": "2865db75ef7de185808e4622afa9e7fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160569, "uuid": "164ad201-0f46-4a47-9caf-3ace05097717", "value": "12288:rcbi8g7rOIbQpc/d9WRnU/Jn47UUqWl4AiX/zeltz2CbBc:rcbi8g7nbVHWdMl4NqfAiX/zeltxbBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160569, "uuid": "d5460881-d2c3-47ba-a264-907c614a06b1", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160569, "uuid": "e8ab4811-04a0-4bd3-84be-463aa6cbdcb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160569, "uuid": "48992d42-abca-43f4-a0fe-267dc2a8c656", "value": "divineleverage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fa8501-2619-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774202828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774202828, "uuid": "aa6ebf19-d1dd-4c0c-80f1-c3bf5ca58947", "comment": "Malware payload (Vidar)", "value": "7e054aa0929a9ca425d387e137c211a1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774202828, "uuid": "acc24913-a890-4d8d-b220-d106243a533e", "comment": "Malware payload (Vidar)", "value": "7e1d19ec4a39f4050f2fb64c9a633f68827fa4896827ac85cffc6ee6c5814fb7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774202828, "uuid": "cab4a562-ec2a-482f-86e0-6322601b4b2f", "comment": "Malware payload (Vidar)", "value": "600cd21e4ea1fe9a4b2ed72c11dcc0ee954b2ddf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774202828, "uuid": "84b543fc-fb71-4a20-88ae-99b12551eccb", "comment": "Malware payload (Vidar)", "value": "b317c5ed74e4ae5e7a0d357465a35805c3d77e69be5cc8156c5c2451c13ff73642d83c2f114eb3ec896b850ec17f6ad4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774202828, "uuid": "8cf9c932-b29c-495d-86d6-fe95a31b89e0", "value": "T17624238ACDF27F81E56E8E3F180AE763FE5331155E09908B5B322D0638B55DB8E1546C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774202828, "uuid": "32e24db6-a98b-4d25-9aa7-91a96878303a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774202828, "uuid": "f5df09b0-958d-40be-b079-a5b413a980d0", "value": "6144:riMKK3lBryySk2PE3h5CGNi9MvYKDxi5eeWHZ:r5KQBrl5HNKMwKDxi5IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774202828, "uuid": "04e5fdc5-7f5b-4836-91df-a94aec22f64a", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774202828, "uuid": "4e9c5b32-2d39-40b4-ab63-7e3ee2c8138c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774202828, "uuid": "e394abec-d923-4170-b57a-315519fddc21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49d3ba1-25ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774191613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191613, "uuid": "6e785e7c-46c4-492c-ae67-2e0173019c90", "comment": "Malware payload (AsyncRAT)", "value": "fabf94d1c4803642943f2fce1bb12dfc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191613, "uuid": "6a2ac91e-2804-4891-bfea-f4ba48c46b6f", "comment": "Malware payload (AsyncRAT)", "value": "800fc1a6a925a30eb93ea93e11c00ac8e6ad5bf769c925633dab5f1713e99776", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191613, "uuid": "5cd51813-dad5-4e40-90ff-4d5479a62a44", "comment": "Malware payload (AsyncRAT)", "value": "ce54795f60acc8e8a2c1bfb39952cf85fbbf25ef", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191613, "uuid": "8cad2102-21ea-4d41-baf1-91b08b8bba44", "comment": "Malware payload (AsyncRAT)", "value": "df04d029a8e00f0a6fbbc2c4b5cb0c6270dc668ce8c70a0c67470351cf93be32a413627dfdd4ee2b814a12e2031e0f54", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191613, "uuid": "6aae320e-2965-487f-9c59-0489a408a373", "value": "T129632A043BEDC465F1BE8F749CF6668545F9B52B6D02D62E0CC410D91A32BC29A42BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191613, "uuid": "124a5d9d-6f6b-449e-89ad-7390d8a32050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191613, "uuid": "848ab30a-a341-4b13-beac-24b8465b0b8b", "value": "1536:k2RftQDXDkUOOQu4fh3b8CpOIvyK0y7yWW3nx:k2RftmDkUOrfh3b8payouWWXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774191613, "uuid": "81fd9dad-3367-4d73-9fcb-45bafaf32d10", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774191613, "uuid": "0522e510-55c5-4bac-872c-a5331638f01f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191613, "uuid": "7b718854-220b-402e-9c46-c3441ca227e9", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4f2b45-25f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774185504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185504, "uuid": "8e800654-5ee5-4336-8b30-364f46c2b9f3", "comment": "Malware payload", "value": "2c69a88733ae273b29a184b14628ea13", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185504, "uuid": "324c9f57-b95d-431a-bfa4-b51167c41e15", "comment": "Malware payload", "value": "814d6288c63867e06f41009639effcb8739d667c7e6a40d9a12d91aa1e3ae9e1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185504, "uuid": "c6131111-4434-4b68-8382-f57bdb7e9d39", "comment": "Malware payload", "value": "7160ccbafeea03c674d9c98ecac38b88f73e0572", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185504, "uuid": "3b2c343b-b79e-45f3-ab43-d3939450aeb6", "comment": "Malware payload", "value": "36a13d11da8aa2a228bfe280ab1927064db02f17363b0ff79a05454301ba8a81cb80c01e635bf9ba9b6cd19253ee1829", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185504, "uuid": "9d07fafd-1d15-46f8-852b-437f6a7de9f3", "value": "T1FDE4B687F1208AC7F44FDA7F14504210AEF0E4704607F2562B6E885E6FEB9C89E657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185504, "uuid": "19509b4d-b7b2-4037-999d-ba935739e148", "value": "6144:i1eMX5Uh/W94gpr2TgPjhMoo4/n17ePCQiAznBA74LUg/Dk0/1+p3x1ZAzi:iJB/QVXvT/1wmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185504, "uuid": "f7fe8ed9-d264-464a-b149-a6c38aae8514", "value": 702534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185504, "uuid": "d3f7fda2-6248-4938-8e36-350ea0aa76a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185504, "uuid": "9b1c328c-8b74-4d2d-8ab6-adb424d167d9", "value": "Krypton2.0-1.0.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec3e1d1-2629-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774209374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774209374, "uuid": "ea83f205-e2e3-425e-8db3-02ef03c1b8d2", "comment": "Malware payload", "value": "9c09ea8c84e71612faaa6471b0a971f8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774209374, "uuid": "bc838d64-7611-4f57-84c3-fce0355bb8a2", "comment": "Malware payload", "value": "8239006e0b4296c0003ebf8a8955d40e7cb751efbcbf6e98490f76ca89bb4538", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774209374, "uuid": "0c4f6c27-45c2-413d-8aa3-8e904e882e6e", "comment": "Malware payload", "value": "ee966616bc8ecff690707762f63b682336987070", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774209374, "uuid": "e7646177-0e16-4b74-8328-8ea7558a7b46", "comment": "Malware payload", "value": "9a8f232606fa687fff88e3ab2c40773e22d6318fa42790ee1db1fa536661dc2abce51861dee31e3ed58d25725d18c98a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774209374, "uuid": "a78e07ea-25cd-485a-b296-8a237ba911da", "value": "T1E42151A7B701F413ABA4CA81C45EBD08FD0A715F9ED0AD97B45A542E4D1BCE1B1DC840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774209374, "uuid": "b86cf108-224e-43db-8ec3-15b3248dd2eb", "value": "24:VWzxauJ50DRDRdDGJ/x9lFlMYQtL32xGQWdVRWiTRWiTRWiTRWiTRWiTRWiTRWiW:VAxnn01Ndm/x9D2YQNmxGQwpppppppEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774209374, "uuid": "739e5a82-c033-495f-ae8d-682bb0ab5896", "value": 1128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774209374, "uuid": "882b220b-e6f3-40d0-bc4d-2f802af601b3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774209374, "uuid": "0075a084-5570-4cd3-84cd-3b03e7398ea7", "value": "test.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdd0650-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.InstalleRex)", "timestamp": 1774160541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160541, "uuid": "813081c9-0a58-4c51-9543-79e5cc94be2b", "comment": "Malware payload (Adware.InstalleRex)", "value": "caff801a280d42dbd1ad6b1266d3c43a", "object_relation": "md5", "Tag": [ { "name": "Adware.InstalleRex", "colour": "#C591D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160541, "uuid": "f073a214-43ad-485f-9fe2-eb8a2ac1fa88", "comment": "Malware payload (Adware.InstalleRex)", "value": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstalleRex", "colour": "#C591D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160541, "uuid": "e12894c8-3972-4778-8c81-8acc9bea9db9", "comment": "Malware payload (Adware.InstalleRex)", "value": "08b9f5874ad1dc3ee1093c9cd08737645f33f13f", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstalleRex", "colour": "#C591D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160541, "uuid": "00ff9e02-9d45-4422-a101-29591a366a13", "comment": "Malware payload (Adware.InstalleRex)", "value": "ce927d2fb602e3b24582b516b95cb72cbf8c55749e591e1cb5672e03b0f6bb78b96976a80f55d691210a6df467c25247", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstalleRex", "colour": "#C591D8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160541, "uuid": "4b3a0f40-b186-4f99-a1e8-b350f5476752", "value": "T1CBD63389F8DE54B9C1528DF49ED0519010E8DBABC793B6FB96EFB14F4248B29F123190", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160541, "uuid": "5223f8eb-bffc-4f4f-b13d-7978676bcfd2", "value": "05ea7b0d93fd49dca73c49b148424e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160541, "uuid": "5b7ccaf7-1717-4c1e-8856-5d787f86a29f", "value": "196608:1UDU1mprZJy2p/HvE/uUhM32f0J0s6mW6W1rsWrzSWas5+VBI/93eiJGDXWku7:10UMpr3dvsM3+nmHW1DS/s5WQRVG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160541, "uuid": "e2e6055a-1194-41d4-99a2-77c278fe3c31", "value": 13370880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160541, "uuid": "75c9d6e9-c200-4d42-99aa-ab39a52a1dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160541, "uuid": "ee95cec8-3ed5-476f-8127-ccfa2326b9a9", "value": "InstallBC201401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41eea93f-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208977, "uuid": "5fe10444-673f-4f3d-8211-816dd0d6fba9", "comment": "Malware payload (Mirai)", "value": "c573919fd2918cfb59ae0ac8fe4bbe53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208977, "uuid": "ece9592f-3342-4b5b-a821-995638f7b11e", "comment": "Malware payload (Mirai)", "value": "837cbeb0525af6bcba6f8f1c21dc015282dcd5656f666e5b1061459fc4046140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208977, "uuid": "c755a9eb-e97a-497c-a6d6-aef568e4883e", "comment": "Malware payload (Mirai)", "value": "1098bad9d48175cc29ca19f429067e9af706201c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208977, "uuid": "3bd4fc9e-82c8-4697-95d4-250bce136c04", "comment": "Malware payload (Mirai)", "value": "6e4875b70b07a9d5cc683e674df7f224e0c45c0e691a16f29b6700dee506b7f9951db4fab78c749106c4feafc423c516", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208977, "uuid": "69dce565-2377-421d-a2f0-a2d270998757", "value": "T18AD3E80ABB511FF7E86FDC3745ED170529CC595A22A83B797A34D828B64A24F09E3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208977, "uuid": "6bfd5c80-4908-4ef8-87a4-3d88a49d6b11", "value": "1536:OXuiWsqNzORgyyody8yRfcNKfoOF5CAKQN8JMHnVVq0Zrd8wPJ3fIKd1ZgTYxj3Z:oWsqNz/cuOWhHq0MwPNBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208977, "uuid": "c9d5caa2-19ad-453b-995f-a18cb4bfc180", "value": 134020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208977, "uuid": "5fe41d19-1db5-4479-8922-1a86c9400353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208977, "uuid": "e96bbbd1-9824-480b-bdb0-4f0b990f42d4", "value": "tux.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af53cc28-2603-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774193269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193269, "uuid": "d65b3e2e-c58b-404c-bf7f-e60f0f02ed87", "comment": "Malware payload (NirCmd)", "value": "cb59f9ce8d294297d9c1d09807833a5b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193269, "uuid": "1672800a-3841-4305-8220-12118885c279", "comment": "Malware payload (NirCmd)", "value": "83ffba5c46b617029a98a1820788af40c52acaa807d059673c360e95c440e18e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193269, "uuid": "7f666ae5-42d8-44b6-9345-da409c0e7a82", "comment": "Malware payload (NirCmd)", "value": "a8da32be189feffe174d281eca2b4c41093b67d2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193269, "uuid": "2ab470ba-18b2-48a7-92b2-563595a55a3e", "comment": "Malware payload (NirCmd)", "value": "95211be2d0b47dc516b5dd6bfafc47d741e9d5b4f806025d360640b5e33421cddedfa4a21ce94e7afe4226f3cfa1a564", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193269, "uuid": "fa0e1117-955e-4e8f-8407-000f9258845e", "value": "T194A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193269, "uuid": "aa002072-52bc-45a4-8dea-bd3de663a930", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193269, "uuid": "72679e00-9325-4e15-9bdb-c73eba1e2860", "value": "49152:ABRyTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aUTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774193269, "uuid": "4bdb2812-d6fd-4851-92c4-a5b494c56478", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774193269, "uuid": "aa9be148-eb37-48df-8a87-16d79a54ecc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193269, "uuid": "f38d3703-8565-47a9-9312-9719bda3460c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25d96bc-2634-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774214373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214373, "uuid": "51c75510-07f2-4d52-b7bd-03f2b6b40ba4", "comment": "Malware payload", "value": "880219440516eaaf3b0ceb10f8de484d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214373, "uuid": "9ce85ce1-79ec-447d-a6a2-2f118e95f75f", "comment": "Malware payload", "value": "8428d2db1f70caaa79934f30068fb4eddd4874ca5702ad53c5c8c12c46513f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214373, "uuid": "c0fdb6bf-d0a4-42f9-8f48-a782d8a9160a", "comment": "Malware payload", "value": "3426c5e764b05bd512fb713ee0fea7e6274a0505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214373, "uuid": "78af3435-46a4-4e00-aa72-9ac681b8c101", "comment": "Malware payload", "value": "c0bb9af60e287ca136c8e2da003f2005cd035e31aa42fcff46ec102a06beec53133023da3e359b01e9dec246b4fc5ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214373, "uuid": "f5d849ed-e52e-47a4-99cb-ad64cb233784", "value": "T116962A7B72A4822CC55ECD3AC4E68F44D5FF75795733C9EF029203684A228C59E7E628", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214373, "uuid": "09390352-b266-43c3-8030-86c488c72862", "value": "3ddebb65c2eb980f7e40797e62c34d3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214373, "uuid": "77dafc3f-129f-461d-a53b-0e2b1dd124d9", "value": "49152:SIpabd5kc+rOhiMj7g5Fh+uuddlS4hwo+MVhRBPO398Q0KHAGCG/vvnvvBsmG+I8:KH3Ot81KHdbWItTWbIH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774214373, "uuid": "0405357f-2a8b-4c55-a5d1-e00823cd27be", "value": 9194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774214373, "uuid": "ad70b82a-216f-4c02-8208-c11c9ba8185d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214373, "uuid": "301d04d9-de9c-45f0-8b46-1d1d6db41c40", "value": "SecuriteInfo.com.Win64.MalwareX-gen.54486257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7813427-2582-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774137958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137958, "uuid": "3f439a78-3868-41f5-8059-f7768d69a004", "comment": "Malware payload (Vidar)", "value": "e81cb76139c95da1e4dd17e749465e3f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137958, "uuid": "9f89344b-ce1a-424f-bf73-e0a6fe9a1313", "comment": "Malware payload (Vidar)", "value": "844aa9ac5bd2d5d9517dd7a8fd06f3dbc32a794a3f0973da94c6436764503fd7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137958, "uuid": "00f078d4-b7ee-4207-91fe-13394b6bdc20", "comment": "Malware payload (Vidar)", "value": "f3200ce263dbdec32deeed886ffdad4b1bd597a8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137958, "uuid": "88543bc5-3aa3-49a5-989f-d31b70fcaee3", "comment": "Malware payload (Vidar)", "value": "0c552517e85a888c163b99376ba93767e011bac8b4b7186771d3249a194b4ef83b02005d1457eb2c57a496371843998b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137958, "uuid": "adaf12a6-ec80-4718-8e14-fd89d62fd881", "value": "T1912422EDB864A75DFDEE12B35542D281FEA44C279FA2D0DEF09C96991F0342D306304A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137958, "uuid": "5591dda0-d083-4430-9cd2-2aeb84042725", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137958, "uuid": "2726ea47-6fca-4c82-a68a-491f19cdd969", "value": "6144:rHsmrfW8+vITyT/myad6zVuWP1IDu9Zv9l5LrdI:rMma8e9T1QWP1IwZFLLRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774137958, "uuid": "783c5109-2f25-471d-8a0a-df606dd96455", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774137958, "uuid": "7cc2d671-b284-4b61-8312-39a44847a5d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137958, "uuid": "4d70b89b-331f-465b-81c3-11504258dfd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dfa0ba-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160962, "uuid": "e0bedd09-40e3-455e-8a7a-6836f4601eda", "comment": "Malware payload", "value": "c03a7b5b662ec86a42a0f55c1a4cd120", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160962, "uuid": "736e8437-7c52-4189-9653-22e0713e4bdb", "comment": "Malware payload", "value": "8590feadc3690353cd2b6f3fdadf83c3431f3ef3fdaee0f43bf5ad49a8203d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160962, "uuid": "4d09dddf-1147-4482-96f0-07cb6ecc2ef7", "comment": "Malware payload", "value": "350a022fb94216e1281e3790143e3d0e8999380b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160962, "uuid": "ba2a5a0e-39d4-4d2f-a192-78ad03c33072", "comment": "Malware payload", "value": "673d0331ae55d140d7c8dd9f4cfce52d13c86b3d829208781476005b8e275526ad51c0332c5255c44ecb2263018b6269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160962, "uuid": "7c6c613f-7d9b-421c-9637-e8a690606192", "value": "T130F3CF11F7180537C472E6BA5A0FDA85C2697121AD20A16735EE0ECCFAE46C07B6E71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160962, "uuid": "9bd6d8b7-5465-4cb8-b1ca-2d9c08c7e94b", "value": "d2dfa12044f6607ab7eb69cb25875c06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160962, "uuid": "2911d1dd-e0a5-414c-a646-fce141f50003", "value": "3072:Q/mLL8RP9+7/VOPkCuYz3GnKV70fUM+CCEkCqkEkOz9LTp:QG4+7/G7f94cTHVkEJz93p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160962, "uuid": "3faf495c-69aa-4d5c-9b49-732c5da1fd90", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160962, "uuid": "6ddc3529-a840-45ee-909e-6f7b1afbbea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160962, "uuid": "d4c37a33-2165-4516-b41f-673aa0f628ed", "value": "virussign.com_c03a7b5b662ec86a42a0f55c1a4cd120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9438a83c-25ef-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774184633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184633, "uuid": "019f1762-9811-4bc4-b915-12784c477018", "comment": "Malware payload (FlyAgent)", "value": "54f8e73cd7e4ab4eed80399fa8754577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184633, "uuid": "4c549d82-11e8-4597-acd9-993d239326c1", "comment": "Malware payload (FlyAgent)", "value": "8654411303cde9d37997f9a7d3e334b2f9640021a2099bc97a75badb92fad9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184633, "uuid": "c2892e38-6d84-4819-9c60-759b2927d2f4", "comment": "Malware payload (FlyAgent)", "value": "9ff52cdf8fbc932b4484f8be173f1e9d83c339c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184633, "uuid": "145b2c89-f2d9-4223-9f28-bb5a33a56b9b", "comment": "Malware payload (FlyAgent)", "value": "912e54eb5ed5be16ca11e58c887d338b4ac44761abb37752728ebe0b269697f999615706621ebd4827bb5ee5e762e1df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184633, "uuid": "eddcc2c2-8039-4421-8cf5-fa236d42e68e", "value": "T139458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184633, "uuid": "8efb8b9b-0dc6-41f9-9b0e-768ee0bc6a5b", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184633, "uuid": "3cc3e742-6d4b-4e2b-aded-b23f55540cde", "value": "24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QQ:acallSllG4ZM7QzM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774184633, "uuid": "95065b5f-7095-49b6-8ee4-680584496e18", "value": 1174395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774184633, "uuid": "b46c0a44-2f46-423c-bcac-02989c8cdfb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184633, "uuid": "3e50207d-60fd-44b8-b77b-b70741573c4a", "value": "8654411303cde9d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3b2d81-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774160753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160753, "uuid": "63a1761b-a050-4a6b-9390-3480585ee72d", "comment": "Malware payload (CoinMiner)", "value": "6a859de32e0ce746d3d4da2c7abda5b0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160753, "uuid": "29a7f0d8-d91e-4394-a5a0-c080ec7bfce5", "comment": "Malware payload (CoinMiner)", "value": "86b90a50d03731b8d25b33382a61628274944d71dbfbc8414c9d9938b7ee43f6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160753, "uuid": "94082688-64da-44b4-94d3-e36a50e1a46e", "comment": "Malware payload (CoinMiner)", "value": "e73904012420b66317a565aa1b93ca9e3da637e2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160753, "uuid": "dc82aced-95b4-4aac-b027-85749c53a699", "comment": "Malware payload (CoinMiner)", "value": "15d1facf2ada7ec22be839bcc7e581dd8159f1085197d3da813004549cea17461034204de3acc2a6ed5ec4fdb59c41a3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160753, "uuid": "eab7d155-9614-4fa1-bf71-87e5a8cddf76", "value": "T15B565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160753, "uuid": "bf9c073e-e525-4d47-867b-76a2975140ab", "value": "c782987849999c5ae345a5deafbd73fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160753, "uuid": "cb65c4d2-9eec-4c60-877f-62d763aa49a4", "value": "98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUj:T+q56utgpPF8u/7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160753, "uuid": "2e117ef6-472f-4442-aa0b-d84c90fe3f87", "value": 6369657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160753, "uuid": "0068a838-92d9-4e5d-b2f1-d5343b23d1bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160753, "uuid": "0025c0de-19af-41a3-ad23-0ec5cff7a928", "value": "virussign.com_6a859de32e0ce746d3d4da2c7abda5b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c445b97-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (DBatLoader)", "timestamp": 1774160864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160864, "uuid": "b2cb01e2-298f-4939-938c-ec003f59c367", "comment": "Malware payload (DBatLoader)", "value": "aba0b8ace9cce65aee02d5bdb5512420", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160864, "uuid": "d100dd88-8bf0-4247-b307-fa3695a423e0", "comment": "Malware payload (DBatLoader)", "value": "87d014ea8f106825f59b25974d96b3954bbbc727b0f7b2083b71a905dbba6bea", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160864, "uuid": "21cdcb70-194f-4cd7-9842-8e50be8e52d7", "comment": "Malware payload (DBatLoader)", "value": "b2c4f0af07da23a169e7ec16786b4f62ca632d06", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160864, "uuid": "bfa967aa-f86a-4818-b65e-17748b6f73f4", "comment": "Malware payload (DBatLoader)", "value": "50239733e3c0feeeebef58186a27fb71a22579a05199bbecddb9cfd518fb65f16f5f743835244d9eb3bedece29126374", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160864, "uuid": "f8fbbf31-1386-47d4-bcaa-23f77c5a5c75", "value": "T169550221A16D8E3BC3B10EBD485E91E055DD79203E6C405E3DE5AF5CBEE3A821A391C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160864, "uuid": "636e2358-d1bf-470c-a874-065bbe5b8539", "value": "3f7b401b4ad6a588cfeed2280d1f113f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160864, "uuid": "abd49e46-271a-49d5-8e58-289c55b90fe2", "value": "24576:g+M5NGTKA8EUY7REc5dhOFgV48hq83zKwsPIKQsjPO5g8e/Rm55Mad/DHp:g+M5QTn8EUYackFWhqQfsQUT+g8e/RdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160864, "uuid": "83e9d5f4-5806-43fe-891a-fbc599b7fd6f", "value": 1331232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160864, "uuid": "fba94c55-3e53-47a0-ad5c-6c3b9759472a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160864, "uuid": "30611384-9b07-466e-b56e-19ca549a714e", "value": "virussign.com_aba0b8ace9cce65aee02d5bdb5512420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0656ee76-25ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774191267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191267, "uuid": "3c5747fa-9c30-43c3-8a03-c5fc45b8d508", "comment": "Malware payload", "value": "42f9ab5946a2315c73c919333164d859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191267, "uuid": "3cdb9e75-2782-4dff-a64a-ec9710efa8d5", "comment": "Malware payload", "value": "89ff3dc670065cd3c6e169a475cb134d52b551207e9e79bd7759c9277a6752e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191267, "uuid": "1ffbe19e-4cd5-4b3d-be52-1d8f8605c18e", "comment": "Malware payload", "value": "cf21ec73a5c10a55c4687f3c5135977867fb0bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774191267, "uuid": "b6a5d218-a21c-4b8f-92fa-bec0b68e87eb", "comment": "Malware payload", "value": "47abba8c551de552bc9793de40110cd793c77be073a9ff5fc72e0ee9cc27d034bbf70f35626914546d46f82e221f3190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191267, "uuid": "56f8f55b-5f64-40d7-9b68-6b7661df01ee", "value": "T136E6335AE2F904F6E9E3C43D91AAC5A4F27374930B6193CB574506512F33BF2063AB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191267, "uuid": "e71370ef-2299-40d8-b90b-b4d833435687", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191267, "uuid": "4acb6a78-bbbf-4e5e-b082-f0ae2d796325", "value": "393216:dip6dCYFxVHFFA1+TtIiFqCuARuAdqMD+2mk:tCYFrHFFA1QtI1CuA0A+Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774191267, "uuid": "964f3426-c8bc-458c-9a91-6cd785187674", "value": 14254580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774191267, "uuid": "58ab9c8f-1df1-4388-aae6-01ff710cc871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774191267, "uuid": "cc1c6977-b5d5-4900-a2f2-233949f619c5", "value": "ZombiePrivateCracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2506fa-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774161024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161024, "uuid": "886dc6f5-1ca3-41be-87b0-712a25ef2a31", "comment": "Malware payload", "value": "d369dfa0f25a86169bcee831214b3c90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161024, "uuid": "37126e7b-dc31-453a-a2f6-ae6bc3e996a2", "comment": "Malware payload", "value": "8a5795bee788ef228b1b5f3b94449a26eb708e2e345faf5dab29b894d73bf66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161024, "uuid": "798ebdcc-65f6-4b26-bddb-f5a942824e02", "comment": "Malware payload", "value": "2efe73ad81e3929012a6c44a2b2687941a5e18c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161024, "uuid": "78cf19c4-c249-4599-88f3-293ae968fc3b", "comment": "Malware payload", "value": "aa61b74b059bb234d263d6c6e385b84548dbd4ce95478affda124e7e7c4427ac5b0961b3821351b2567de3969e3415e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161024, "uuid": "09168f24-2fe7-4646-b75a-9658d33d6346", "value": "T1F673F83BE66380BCC187C67877C6A9B069BAFC050435774E4786C7213E5AC606FEDA85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161024, "uuid": "d83125e0-abef-47a9-8527-479de9236982", "value": "b835968a1c9d213a656dcb6800077702", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161024, "uuid": "8ba3e8da-2d2c-4e00-9f83-54fdde5fb403", "value": "1536:nDqkTmKryG0C1IE+rb+l2+dEK5yfpZS/Heiaidk7RAyrAMZ:DzT/yG058l2+SOyrAMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161024, "uuid": "aa75cdd4-534a-49f5-aedb-6422a62a85c8", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161024, "uuid": "3ef04790-0fbb-4af4-8011-01ce00571b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161024, "uuid": "a6b6701e-9020-43e8-a11f-90a5415f0af5", "value": "virussign.com_d369dfa0f25a86169bcee831214b3c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa785c6e-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vilsel)", "timestamp": 1774161048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161048, "uuid": "84655a95-6828-4e0e-bbbd-372f4d87896f", "comment": "Malware payload (Vilsel)", "value": "db8f1151c1e572bb402fb2769126a980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vilsel", "colour": "#90291C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161048, "uuid": "dc021b97-5702-440d-a226-7e32b8816241", "comment": "Malware payload (Vilsel)", "value": "8b644efdbe9255fa517a5112985957b3aad7d4759e448cc09f65c612f620d2b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vilsel", "colour": "#90291C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161048, "uuid": "5c713fe9-3b8b-44c1-ad73-74fc70a59f38", "comment": "Malware payload (Vilsel)", "value": "40438636601033fe008d53018e7e7b9b38f0132a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vilsel", "colour": "#90291C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161048, "uuid": "6c7b9e3b-b5b2-4049-bb07-2d102b0af4ff", "comment": "Malware payload (Vilsel)", "value": "eed8dafdf3e4fc162b737bb473f5c178b430e3ae0210c75117f2dfd95f9c043165187f8b6302714324eb0e39e3862cf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Vilsel", "colour": "#90291C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161048, "uuid": "c1569679-4db2-4981-91e9-88afac47d117", "value": "T116C34B5FB3460772D2C103B2360B99D6B71A9D79232A8A90506CF12E2377E7C93B7791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161048, "uuid": "faaf7486-7750-4e4b-a932-25c983c5dd4d", "value": "672cea158ad09bbe247deb3d913b4d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161048, "uuid": "e25e4277-b15c-40f0-bfa8-4b503f8d1127", "value": "1536:lvm1Fu8AjYaFwjRUdW7fmyY7aZYJVmy0KQbj6vbjuKoauGi45:6u8ANCUdgfmD7zey0KUj6TjR9i45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161048, "uuid": "d8216925-dec5-4c38-b93c-0a5383ef3122", "value": 125544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161048, "uuid": "3ae423fd-1361-407d-868a-915c51af2674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161048, "uuid": "497fd9bb-b8db-401a-b3e4-4b0e8010fcb6", "value": "virussign.com_db8f1151c1e572bb402fb2769126a980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b087e0e8-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774161059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161059, "uuid": "48e1e218-4afb-4504-9804-f7ba2062d145", "comment": "Malware payload", "value": "b59502570717e3e77a6c4fdc6d146650", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161059, "uuid": "a8b4955f-ff9d-48f8-ab2b-bbad640c697e", "comment": "Malware payload", "value": "8e9a315d42bbaed959f67c5457b11a4866a10b41663859bf868b17de1b6713a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161059, "uuid": "5800107c-ab62-4d3e-9212-78f0a9a83832", "comment": "Malware payload", "value": "243dfe2373a571f94a37433b8d60d490947042c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161059, "uuid": "ccf3540b-b452-4cf1-b394-cfb5ca1fbeaf", "comment": "Malware payload", "value": "5e494301cb2a606b7fb7f5d304c41d999b069b3eae268cc70ea64386a6103ca8463a195723ee16a5c79a2e0f02f8f52c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161059, "uuid": "f71fdb5f-67cd-4243-b72f-99dc53f42d13", "value": "T125E3174170948CF0C88641F862C8A931767C93542B1BD2E7385DA3F9CA583FB79BD6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161059, "uuid": "807fc01b-8b64-4603-8e1e-ec06ee5d4070", "value": "c0f1bee81d338a4715051afeb5a33c54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161059, "uuid": "469da305-d8ee-4e57-942c-3791e8d2ea6e", "value": "1536:0O/L6bYZosP8ltV+lDtwVsm5NVlfr17gX5xYkUM/zsJ9TRy3r2M:qTVCeJ/7gA3MqyCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161059, "uuid": "8d6713c5-df3a-49e7-9d38-b7ccf8977c49", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161059, "uuid": "e0846006-f3a5-48a1-870e-41bbf7b7b018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161059, "uuid": "9e8ce16d-5247-4242-9963-dd126e139593", "value": "virussign.com_a9b596fe171705053b2ebedc5b90a860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82e4fe0-2604-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774193713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193713, "uuid": "29b7909a-ce11-4b34-92ac-f392db72779a", "comment": "Malware payload", "value": "2f1fc9e39bbe4c2c22319fecdc51b31c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193713, "uuid": "4e262cf9-bea0-44c5-85e9-4607bac5b147", "comment": "Malware payload", "value": "8eabe13f64ae595aa7d054d4005102613a3bfaeda0427c732585777f33a685d9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193713, "uuid": "d9f7c3d0-54b4-4d34-9a1c-8d1a7d2cb2e5", "comment": "Malware payload", "value": "b292352a378b9824446256d17be355e88423d694", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193713, "uuid": "0026a7a4-83a3-4453-a3d5-98f09ad2e2ad", "comment": "Malware payload", "value": "ff32e20fe68cfb1d6d8138c5794693872f4c5cca4bbe46a650f5bc2045b1b9052be2eb16bd47b745dbff7b1ea59edf81", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193713, "uuid": "89d16f0f-e9c6-4e8f-b4c6-0cde850db7d5", "value": "T133924BA916496C79BBC0DE7D9F3C7F0CADE881C02218A39CBE4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193713, "uuid": "6a782a3c-a975-4969-809f-139025ae0ac4", "value": "384:1OX0M3vgRjGlsaq7K4zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:1OzmjfpzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774193713, "uuid": "624783b2-5e2a-45dc-871d-7fdcd77c2ef0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774193713, "uuid": "e5be05e3-efe4-47b5-84f2-417c6e0bda08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193713, "uuid": "8d1dcf81-c565-4a71-baaa-f1c476d638d4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a89eaff-25c3-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774165558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774165558, "uuid": "9a3dd7d4-ae0e-4cab-a8a1-0d5ee0869bc4", "comment": "Malware payload (RustyStealer)", "value": "0a44831fd66317b365741a88fae40e25", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774165558, "uuid": "f3f90d9a-c9a4-48e1-888d-0b15d592622f", "comment": "Malware payload (RustyStealer)", "value": "8f7c9fc8220f2ea82caf6e26d57514b24ce594b1d3d042c538cb81bc5a18cb1a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774165558, "uuid": "b3a3ca1e-26c1-4b4b-a51b-6c4779aeaa5d", "comment": "Malware payload (RustyStealer)", "value": "9562c1e93ac908cc64c8666ccede1541036c0469", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774165558, "uuid": "b1b06c4f-2369-4035-ac7e-f43c2a400bdc", "comment": "Malware payload (RustyStealer)", "value": "7c0d0f976aaedb6f56a2499477babb7cff3f910f6a295841b445e55fcb486982e1bae967a30fb742252d2da623b141ea", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774165558, "uuid": "9137ebab-8fc7-4b2b-9870-dc702b899b62", "value": "T15ED67C1014D96607FD7ADFBE89DC76480F7AB2913723FA2897410AED4FD1B49CA025A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774165558, "uuid": "7edce2de-710d-4cfa-ada2-56cd09143e93", "value": "196608:apTeeYX0BihIuLLY6I/a4v9SXGuZ+XaSrlaI:TaiiskR/sXGujSrlaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774165558, "uuid": "28eede75-417c-4ff1-8854-9b5c617416db", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774165558, "uuid": "8c96ca8c-350b-42b4-b582-f0d67743b4ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774165558, "uuid": "8f9a4af8-7f21-4503-b90e-67ffc4ace59e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065a2f10-25e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774177953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177953, "uuid": "fe98f52b-bfdd-409e-a8a8-53055366c925", "comment": "Malware payload", "value": "a009ca69c2abd7b67c6a7a7ac1f000a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177953, "uuid": "ea42945f-40a8-4d81-8136-4c0f861a5474", "comment": "Malware payload", "value": "8fa2bfe82742ea8e21d0a889cdbc3444e5e783159d5063f390678d9aed6c72d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177953, "uuid": "4d56c383-cc4e-4471-aabe-fce29f784c21", "comment": "Malware payload", "value": "2265e86f679a1cf096d1e8d6ab3621bc2fcef2a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177953, "uuid": "88bc7421-f020-47e8-acd4-240071f86b14", "comment": "Malware payload", "value": "b906c4c6ef66edbe91a8d1c66da6fb33e403fe0ddac2a1c3de2597d83f79f86162c622de55ec47a752985d3d924f2e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177953, "uuid": "cb002973-00df-4703-b0f4-1b9e9c10d805", "value": "T196D733527B8500F7D2D667F9D06CC0208E2F62BD21E6710F3EB19A6D183EF11653A97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177953, "uuid": "24d31bac-6fc4-47e7-914b-053a3d0e448b", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177953, "uuid": "335804e7-468e-4c07-a862-7b7247e0016b", "value": "1572864:75VwXSLoIsmj6JkXJZZfItMzOXQ/tJaJ/xP:tPzsmj6RMzOoOJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774177953, "uuid": "f2d8d3d3-0461-4256-a3b1-5c1ff26d0594", "value": 62923600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774177953, "uuid": "e2fecbbc-14c1-4627-a2f5-ac5df8bb9bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177953, "uuid": "d780b236-272a-4dc1-a056-07b47d903296", "value": "Claude-Chain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2511800-25d1-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774171772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774171772, "uuid": "47e779c2-899c-41fd-8dd8-b94fbdcdc63a", "comment": "Malware payload (AsyncRAT)", "value": "4e8258d5cb949f29eaa7f10248fdb6bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774171772, "uuid": "5327ac50-77f3-4100-baaa-5ab24b145ab7", "comment": "Malware payload (AsyncRAT)", "value": "918eb07f14d46e021e115d6aedfddaa081efa60929eec93d4b3fde17b04571be", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774171772, "uuid": "9d3ef5cb-cdfa-4c06-ae59-1c7df071c354", "comment": "Malware payload (AsyncRAT)", "value": "5e60aca3b139801887548c1352be7bbf6f26d462", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774171772, "uuid": "0dd2ef4e-9b14-4584-badb-aed8fb0881a0", "comment": "Malware payload (AsyncRAT)", "value": "b82bcd34c345d9c3b68e1c083d8898d06a40c567d4700756ebc26f5178700253083832e2fd543a4c1750136e88420255", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774171772, "uuid": "e5e2e0ad-d2a9-4700-a3b9-1ce38bdc982d", "value": "T1792319047FE8C26AF1BE1FBD59F212110379E2576503E75B0ED051EA1A237C98E147EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774171772, "uuid": "abadf6a8-dad8-4fb8-bc57-94f9b59955a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774171772, "uuid": "d7b145d4-7ded-4543-9f28-622cf993557c", "value": "768:0mTehDGh0W4gjhjrju3TKN1BDA/XvuIolQ2J3JYforWSqVVy/eFkJaliSr:h64NPS3iDAfvA62nYfIaliSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774171772, "uuid": "c8ef6890-40b9-43b8-85c1-f522a07c65ce", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774171772, "uuid": "f1768d47-9aa8-4bbf-b50e-be4e6926cc83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774171772, "uuid": "f01574ce-9655-467a-af1f-cf1cf88ac274", "value": "91clubgame.games.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81aaabbc-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160550, "uuid": "942c1594-dd53-4e32-be52-ef32a0ddf749", "comment": "Malware payload", "value": "845b54844e8be6c912947bdb8798c927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160550, "uuid": "2e83984b-4bd7-488e-9b8f-850d738e4c6f", "comment": "Malware payload", "value": "91d8e75e88d401e64b609e637fae7a9594df6ed0e600f3c63bbb69d0cdec21f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160550, "uuid": "61eb560c-f3c5-44ce-8087-89337797d87e", "comment": "Malware payload", "value": "2f243455274d41e259d19ce7f81035d0f4faedaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160550, "uuid": "bf9ffc48-33f6-4f4b-9323-8cb258806f1e", "comment": "Malware payload", "value": "70f76b98fcf6f51425fe4f89fd1ec5c6d8d1ee62c15635994fc8c655069e58105f6e349e2ca686d7cc03c8eb9699224f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160550, "uuid": "2dde4fda-64a4-441b-bb64-33948e863c96", "value": "T1032633A7ABD3F2B2FC1015722BF80A5FCFECA634E3541157AF089506322DB875626536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160550, "uuid": "c33772da-9b66-4f0d-8f90-e1986ffb9612", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160550, "uuid": "3346abd4-fc13-4589-8d14-dbc278e303fb", "value": "98304:iZniHk6BmdCZ04K+oC5dSlvvGjH9EfdSOhcCa5iKFDMH6YBZnx3XPK55zMWi4ZZ3:QiENCO9pQdSZvGuQOhCMJZnxHPKNiSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160550, "uuid": "80816e3a-9b73-4b96-b446-44989ad18eaa", "value": 4705879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160550, "uuid": "9f8867b9-fd41-46ff-8cda-33bfe3a70e48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160550, "uuid": "87484eb7-68e7-4565-9a10-959faa38260d", "value": "Install_LiveManagerPlayer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115379c6-259a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774147907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147907, "uuid": "f1deaf05-f17a-4aba-90b6-ffeb42a1f5e3", "comment": "Malware payload", "value": "58e17c71440008effb520b4a71c34df1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147907, "uuid": "c1b6a47b-dfb5-4965-b205-3f344e62c293", "comment": "Malware payload", "value": "931601f560a54680b33f9aad7e3be2b95eddd4f2dd1db01898fcc2299b2ce64a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147907, "uuid": "a8891213-6d32-4de1-ae93-1cbd6deacc7e", "comment": "Malware payload", "value": "60fafee2099ad18c379d39cbca3fa3a5c67e9554", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774147907, "uuid": "bbfd7525-e5d7-436d-b37c-a96749363c59", "comment": "Malware payload", "value": "6a7381a82195d5bb413d6a2d19645ccf63309ab734c06b305723971e5171230609640e092ad4dc3c9dfd7aed8376f6cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147907, "uuid": "02088912-903d-4682-b0f4-c10f8d86ffd8", "value": "T161925BA916096C79BBC0CE7D9F3C7F0CADE4C1C02218A3ACBA4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147907, "uuid": "9a01dd7c-ee38-4678-831c-b04c8a1e1e8a", "value": "384:pl0M3vgRjGlsaq7LNzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:pdmjftzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774147907, "uuid": "cfb3b2ac-94c0-42ce-85ea-0319978a3548", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774147907, "uuid": "c3d33c4b-06a8-4b1f-9a42-e7040d28b974", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774147907, "uuid": "3cb97fe5-3817-48e9-aa0e-ee9c8f64470d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7c47c8-25e3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774179440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179440, "uuid": "d38280ea-93e0-4a7c-8155-2839305b56b4", "comment": "Malware payload (AsyncRAT)", "value": "d7dbbca5cdbf29a6c5262dd03dd90be4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179440, "uuid": "d2c99667-bcff-4e04-863c-821616593f1e", "comment": "Malware payload (AsyncRAT)", "value": "93ae860b34d78429fd3f4140cb2ca139bed29fa0f81d99cd35dce8f8024b0f0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179440, "uuid": "4910ce28-2cee-4bd6-a1a1-f6e8fe3f7222", "comment": "Malware payload (AsyncRAT)", "value": "881b9429acc6d3c48699efeb2210d7755a7df82d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179440, "uuid": "e9cebf99-e623-4a31-94e9-8a45cd3a33a4", "comment": "Malware payload (AsyncRAT)", "value": "3ebfb54f7695fc26e2beb8966b05cf68fe32a12b475748626beaf16d1ed83e16ea71db5d0d882e577845ba80bbb089ff", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Dapato", "colour": "#AFBAD2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179440, "uuid": "62f01c86-72d2-4200-84a2-c4e8ab9ab4b3", "value": "T18CD523A4B05B89FBC4679477A8263A4CCFBE1EEA0861191D20755EF2F91A804C1F1D7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179440, "uuid": "e70cdc3e-577f-4680-8c3b-247d7d472614", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179440, "uuid": "a3cc83f6-6b11-419c-8948-73ae61c9556d", "value": "49152:a3NXPZdbJxx2azExp8h4nqSahFhbCemo2YDH6V2J+esJoKqVB/r:a3NXPZx7zE7tqSWhQXYDFJxsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774179440, "uuid": "496d83e7-7b05-461e-8bbc-e330c34e2a16", "value": 2758656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774179440, "uuid": "078976c5-eb40-4a41-960a-f9398e10dbac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179440, "uuid": "00136893-3662-4dd7-826a-e881e9076514", "value": "93ae860b34d78429fd3f4140cb2ca139bed29fa0f81d99cd35dce8f8024b0f0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239dd0b8-2609-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774195611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774195611, "uuid": "fac3462e-ad26-40b5-9cac-14f55239f6c8", "comment": "Malware payload", "value": "a3598977074ad5f70b7e2954a1b6f4f2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774195611, "uuid": "c31a174b-3d28-4f5e-ad4e-d65554d65046", "comment": "Malware payload", "value": "99778434fa47a2264a4db4046c012289646d256b5b5373c88727c5a935f2e679", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774195611, "uuid": "20e14a6d-ba0e-4a6d-b0ac-d3008171ba3a", "comment": "Malware payload", "value": "fa2ac01fbe4a0546ddfea81972c7ed27292c1260", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774195611, "uuid": "0d9bec78-719c-45cc-a010-7183a63ec607", "comment": "Malware payload", "value": "ee5149ec474997e3ef893dae75bb4a0dedf450a23518dc28fe753dd137397a645e1ff5bfddd7b129771c9b178dcfb5a5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774195611, "uuid": "92e6b462-184f-406c-8c45-bf301b6275c0", "value": "T1E3318671745050050A1EF462DD181B24B26E46DE1F4DDCFA9163233C3DAEB970AF7322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774195611, "uuid": "23ca4216-3332-42b3-90de-7f0b8b02ed8f", "value": "24:5uk9rBZFJLNV9ia9DJQ+oSMDnX0cKL4uqhV+qh5WktyxXHKFVUwXX4l:n9VZ/LH9fvMDX0c9hV+qhYk0JeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774195611, "uuid": "1ac575b2-1a02-4842-bbbb-b2a55e7dca21", "value": 1491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774195611, "uuid": "f0b7219d-add6-499a-b9a0-6c80f25a15e7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774195611, "uuid": "000a156d-04f9-42a2-a30e-f5fd6efad0ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc3e50a-2619-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774202848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774202848, "uuid": "15cbe9e5-17eb-4356-af20-47962f910929", "comment": "Malware payload (Vidar)", "value": "94f80bc334768d7cac512445383fd976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774202848, "uuid": "363b6b7d-8e6e-4423-beec-30f652ba92f8", "comment": "Malware payload (Vidar)", "value": "9a26f4f5358b7b3cb881100f88818595df1b38af266020e64a63aafa8b533466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774202848, "uuid": "a3bf4273-b9b7-44f2-8d26-78c6a0a511dd", "comment": "Malware payload (Vidar)", "value": "50e57bec585ede8a2d53e6de1b6604b02183864c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774202848, "uuid": "5bc4430d-d0e9-4ef2-9e36-f9db04d0a448", "comment": "Malware payload (Vidar)", "value": "f3bb2ec8ab801bd2bf3a81d9b21459f095d06d21985b90bc27201a32db0bdc2c24510e809cad24327204a3bd1503a41e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774202848, "uuid": "6b9320c8-f562-4a97-8943-4b15d1965ae0", "value": "T11FD42BFE9D60E325F60DD0BAE247D7528F2138011236A6A329BEA3141245873DB677FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774202848, "uuid": "59eea552-69cb-4913-ad4b-798d3f2dd76d", "value": "12288:rXauuPSlU5B0umJF9Iv/ht+JSe9gke2nHDxH1Wg17RWc:DTuPSlUzuj9Iv/q1PGgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774202848, "uuid": "c8efc056-ed63-4b4a-a2ec-abe6d5a2f601", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774202848, "uuid": "1e117a32-c948-4aa8-b060-09a80e6a9806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774202848, "uuid": "825d604e-fc44-49c3-933f-4af34e6a97fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe48a9f-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1774160870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160870, "uuid": "2c5e4bcd-6208-4c7f-86d0-eadddb1a2af4", "comment": "Malware payload (Worm.Ramnit)", "value": "abb7e42336b31b63e6a21ba4f0ad9550", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160870, "uuid": "d2cf332a-3495-4ed5-b47b-fedacc981e93", "comment": "Malware payload (Worm.Ramnit)", "value": "9c5516df77f3f4df40ba50112cf59822b49f909b7fd9dafc322a0dd62dc2e95b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160870, "uuid": "a115edaa-7b45-4115-a1d9-02f4639d5d8d", "comment": "Malware payload (Worm.Ramnit)", "value": "a642436c65caa6fc01d3abc2b57a59851466ce64", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160870, "uuid": "c098a24d-8407-45e5-bddd-5e654bb8c5fd", "comment": "Malware payload (Worm.Ramnit)", "value": "61531d3deedd1104682c630c23083138737f16e230a70f99091bb10795b736ac094cb11979aaa1f5445c17b32b0e193c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160870, "uuid": "402868f6-47f2-4cf8-9325-739cee0fd178", "value": "T1E3712E23A75644F3E6054F300B4B4A82E6FFD27A0374482C4F0556183EE22AAE72AF49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160870, "uuid": "7c5bfe74-616c-4672-ac21-c64b9710571d", "value": "b6f391375d741ab65301de3824d105be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160870, "uuid": "9c45120e-9f96-4c29-b544-e03d391d6efd", "value": "24:eH1GSY19vPQeDR21SMwh0tYPFThtdnIUovRidLYH/B/gUSh:yY/gqQ1hWMStdnapidc5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160870, "uuid": "ee97ce28-0010-4eaa-a21d-2ddea706f7cc", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160870, "uuid": "c2ece648-803e-4ac2-b48e-87bd74655921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160870, "uuid": "3e701cbe-852b-4413-b07f-36e7ecd27684", "value": "virussign.com_abb7e42336b31b63e6a21ba4f0ad9550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d714e6ee-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160694, "uuid": "9601642c-86b3-406b-9420-9946287fe379", "comment": "Malware payload", "value": "416686f4be7aa5a11e50ac2a992d2670", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160694, "uuid": "b2f41e3f-bbdf-404f-b65a-fc711aa1f7a4", "comment": "Malware payload", "value": "9eff2f5007b0b08d59e1952308f93aa6f7e65030d0d6e57dc2a5f47bc8a9556f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160694, "uuid": "9490ca8f-fbfa-4b29-a392-c71d2376296b", "comment": "Malware payload", "value": "81b98962451730feb284964e0f9ad825634cc7f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160694, "uuid": "e9325af3-6647-43bd-a329-d8ad6dce08c4", "comment": "Malware payload", "value": "1212b32aca773c7ca46a83898321fe7ec8762e79e4e28b4e6857685220e4b8887741fc55fd0f8b2e317d79f539bd438a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160694, "uuid": "9dc6ac04-873c-4b62-93e6-cb25307ec9b3", "value": "T19B92F70523E8C375E6FF0FF02C73A7408BB6E6469526DF2D5898B0491AA36544AD3B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160694, "uuid": "6f47fbd3-e7a5-4708-a10b-33f6a3dce861", "value": "384:1IernblyjnAZuqwUblWJmFrGhG2G+f5QbQeQwiHYsiSq6RKWGs:KelenAZbCDG2/5QbQeQwOqAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160694, "uuid": "1ab32e61-8ca2-44a7-ae25-2726f1ac5b72", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160694, "uuid": "2f02ac56-bdcc-4d6c-9abf-40997e4faeaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160694, "uuid": "d74c1adb-7635-498e-8e08-d06d823bb705", "value": "virussign.com_416686f4be7aa5a11e50ac2a992d2670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c88e613-25c3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774165588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774165588, "uuid": "55e5b9d6-da14-4a31-827a-0ec9869ab93a", "comment": "Malware payload (AsyncRAT)", "value": "16ef97504f39dedacee8bd6b7b207c4f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774165588, "uuid": "afa22938-b672-4b44-8bb9-2f59245c0c34", "comment": "Malware payload (AsyncRAT)", "value": "9f456ac3a5cab72c7fa76e7dfb5aa41a45592bae2062bda92a46f09336a22c10", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774165588, "uuid": "7ab5111a-bb02-49e5-a0b0-2c8bc2e6455f", "comment": "Malware payload (AsyncRAT)", "value": "0562b4eed4a4f186a6ec49ea0d98238fd0596ee7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774165588, "uuid": "ba6012a8-711f-4fda-8284-57eb9e522cc3", "comment": "Malware payload (AsyncRAT)", "value": "be7c9540ef387b8d07639faf011c6aa3334c46dc06e0853b93f3736e927cf054902200bde3590f2bc83f9002fe360ba4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774165588, "uuid": "8af59e9d-810d-453a-b4a2-ba6d1c85e53b", "value": "T19A2319047FE8C26AF1BE1FBD59F212110379E2576503E75B0ED051EA1A237C98E147EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774165588, "uuid": "3d37dd11-5123-4307-beca-463a2f9442ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774165588, "uuid": "79672997-3fe1-4e59-b9ed-b1a179b7730d", "value": "768:5mTehDGh0W4gjhjrju3TKN1BDA/XvuIolQ2J3JYHorWSqVVy/eFkJaliSr:064NPS3iDAfvA62nYHIaliSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774165588, "uuid": "705a8e27-b935-40f9-8cb7-723dde029bdf", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774165588, "uuid": "f5238ae2-fa79-439d-b167-23a2550ce308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774165588, "uuid": "e905c428-a568-423b-acdc-5f928b4455ee", "value": "91clubgame.games.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df47eaa5-259b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774148682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774148682, "uuid": "cd8d92aa-b839-4b2f-b76e-68ce03665ab4", "comment": "Malware payload", "value": "a10873199eea95a685048b2af0c50d6c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774148682, "uuid": "f996821c-548b-4482-a68e-cb7298902e8d", "comment": "Malware payload", "value": "9f54d5cb751016d73e5dd05f1bf960872cc305f808c89366073e5dd63a237bc1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774148682, "uuid": "13760bc3-558a-49e3-bcb2-a02999bf8a99", "comment": "Malware payload", "value": "3656be1e85b6bdbfd39a781e92125db0584f4963", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774148682, "uuid": "ac19f60b-4388-4a88-b783-c027fbdc73d2", "comment": "Malware payload", "value": "1f6a6d775c3c1d00c2cc2c8ba81d0a2c2e89835198c8488eee735b204853d096931fbe714913eac67c0246efb7101a02", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774148682, "uuid": "f1bab822-ea8e-4a99-a5be-02ee2989e08d", "value": "T17D925DB512496C79FBD1CE399F3C7F4DADE882C42124A3ACBA0F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774148682, "uuid": "714a680e-dced-4be4-9460-ed5dc7f125f2", "value": "384:4FcuQpWx+BL0SWL0gizsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:4F8i+BL0SI0RzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774148682, "uuid": "84a25212-4a83-4b79-a4cf-a5d7968d27d2", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774148682, "uuid": "b0a76000-4ea4-4342-b63d-c2080cc9ecc0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774148682, "uuid": "e4be24ff-ea64-42fd-b4d5-1c66c9f87639", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d6684a-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160631, "uuid": "d61983ee-5d35-448e-b322-0599b42b2d6e", "comment": "Malware payload (KawaiiUnicorn)", "value": "0600f81ada2d96f531f084b2c0ba0fd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160631, "uuid": "d8d7de10-f47e-4b17-ba51-9d0a06e51a15", "comment": "Malware payload (KawaiiUnicorn)", "value": "a15da37e544d66e0e5fd1e1622b7018f2ce224a9238994653b7f6ab20a9420c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160631, "uuid": "495a54f8-d41b-4935-b010-72ed571d867d", "comment": "Malware payload (KawaiiUnicorn)", "value": "0058b7afd3a3ca380c34973ad6ae4abcdebac171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160631, "uuid": "61735334-8541-425d-a477-656a3f4d1fc6", "comment": "Malware payload (KawaiiUnicorn)", "value": "37f676bd19ef22e628558100d3b32563fe126f535386312412d0a5691f1da8d8b6288f11d104a3913f101afcee58c4bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160631, "uuid": "0f916e86-d4bf-467a-ab09-19dba516832d", "value": "T172A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160631, "uuid": "ff6965f8-42cb-4005-b1ac-a4d2c099212f", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160631, "uuid": "d7e3b8a9-761c-44ba-83d6-9d95012575e7", "value": "3072:sqiOogJct28UF7YpPzJyrfL/JpL10XpqemHx+lZ65tvbAOrYUmls:sqTo5XUFaPlyrfS56x5tzbrYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160631, "uuid": "ec23c61c-5ef6-4eaa-b4e5-d9de2dddb3ab", "value": 479262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160631, "uuid": "4f1b5bf9-f644-4293-a80b-49f0203a955e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160631, "uuid": "9aedcbec-469c-4335-bb78-45c60cec2e01", "value": "virussign.com_0600f81ada2d96f531f084b2c0ba0fd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a33f40-25e4-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774179745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179745, "uuid": "c0b831fc-5214-455d-9c32-bf973adeac49", "comment": "Malware payload (AsyncRAT)", "value": "0808c5390980c2ccc867a58f2fd9327c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179745, "uuid": "73ee034f-5a80-4256-b11e-31985842b923", "comment": "Malware payload (AsyncRAT)", "value": "a1670d32949b4fc91761123c2e8fc2e8493183430dcc5fada051f14bf8a70811", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179745, "uuid": "59308dfd-0f49-4fef-878b-362a28b03e88", "comment": "Malware payload (AsyncRAT)", "value": "96181518f1adcceb302fc9ef27747e4b4133f93e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179745, "uuid": "3a4a4f72-9404-46d2-a541-14d8a413cb04", "comment": "Malware payload (AsyncRAT)", "value": "420ecfa8db408e297481994a7d59cd50ec640acdae49d4f992805191f40365fa5fdf07e14dacf3e850fd343a2d7520f0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179745, "uuid": "077633cb-ba3c-4cb7-bbff-e2d6bb294cd6", "value": "T16A232B103BE9C22BF2BE4F74ACF22245867AF2672603D5492CC441975723BC68A525FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179745, "uuid": "6fe0d58e-9067-4822-960c-7a563de68d90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179745, "uuid": "29aaafbb-a339-4950-88d9-ed524a35c428", "value": "768:xuPfZTg4pYiWUU9jjmo2qrHZYsYNiOPhAPIOCz+D5FgYJo/0bb+qjFqjhDQNE6hV:xuPfZTgKa2FbiqnOCKFFgHcbb+20jhDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774179745, "uuid": "8a8e66a0-5fe2-42bd-a545-6597a0d09937", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774179745, "uuid": "9dd05b6d-93e9-4ebb-9f61-222a79713ef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179745, "uuid": "1205cad9-16ab-44ca-a364-47c5ab1d08f2", "value": "a1670d32949b4fc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18294b3-25fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774190373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774190373, "uuid": "0362a608-bd95-4a1b-a483-b40b94122f24", "comment": "Malware payload", "value": "641797b7e5e34e797e21f489860a19ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774190373, "uuid": "8116b482-d72c-49e7-bec7-ada0826a7e3d", "comment": "Malware payload", "value": "a29674fdde72fc86f9687c3a82d18f2e94cae6177b25c35e61d9a4f4e4039ed1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774190373, "uuid": "c13e72bf-4b19-454a-8b5b-b601ee97bb04", "comment": "Malware payload", "value": "772d4bb2fd6753e6222d0fe9b99c12df6df8c5d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774190373, "uuid": "1b4adf79-52e1-4495-9819-04ab83af8a3b", "comment": "Malware payload", "value": "fefefac5df461e75b8f7ccc893b63ba823bcb05bced1f74b00ce2ec90c26360342b18e85e3be233ea09b146256c7ac32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774190373, "uuid": "358b9275-417e-44fa-890f-8a3a97eb8d6b", "value": "T15CB396096FA10FBBDCABDD3702A9070139CC651B22A43B7A7674D528F54F64B49D3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774190373, "uuid": "e4a9a70f-fc90-42af-9fa8-8d6c2c04120b", "value": "1536:hR3ynCmOtuIjSdAR+B+1L6JePXxc20gw+nz+K5NbPHSxGZli/jClV:6CmOtuIjgBqLrVNToGTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774190373, "uuid": "2417a841-470c-4cf9-ad38-1de2492fa48b", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774190373, "uuid": "f0f1b4f6-3c14-4eac-870d-f232a7dee4a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774190373, "uuid": "b7b536e0-1626-46e3-833d-c41408142d3b", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45acf617-260b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774196528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774196528, "uuid": "dcfa7878-a20f-408a-ae2a-3899b9ac9251", "comment": "Malware payload (ValleyRAT)", "value": "67bdc48dbcbe686cab71f9e3fd8a71a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.H!ml", "colour": "#8BB97C", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774196528, "uuid": "f69409a8-5ea2-441b-a9ca-6ff13eda1da6", "comment": "Malware payload (ValleyRAT)", "value": "a47803a514f65e1c94a01f3ba83baaf2547a94ec266b92def5df8232ddee5cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.H!ml", "colour": "#8BB97C", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774196528, "uuid": "622ed2ee-ec94-4d4b-9120-54f0536de98f", "comment": "Malware payload (ValleyRAT)", "value": "f4c6b4fed811e4223239dccd4c536ede1d8881eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.H!ml", "colour": "#8BB97C", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774196528, "uuid": "1473b1df-3ed8-4e8b-bf34-0e7b8eb3d09d", "comment": "Malware payload (ValleyRAT)", "value": "67cc6803cfc60f27d554ea61c18b044fefc16a3ac37592af1d7ac386bbc89acdbe677c1147de29982c2733dac5d607bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Wacatac.H!ml", "colour": "#8BB97C", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774196528, "uuid": "5c506a87-a018-44d4-a489-1eb7ac04f26c", "value": "T11695180AFA7581E0C4BAD079D5A3666AF8713C4987309AE35746BF1A1F333D0E93A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774196528, "uuid": "50bd38c1-79f4-461e-871f-3df2599df84b", "value": "e99bbbf2c71e32ec28ec8a86aac5e1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774196528, "uuid": "b13b2e90-691a-4758-b3d1-d2f05b80fd54", "value": "49152:W8YqJu7nAuYMECIycFpw6RvPl2TaVdxPs9Fvcw5OZhiuo7j81lU:77iukj8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774196528, "uuid": "38eb6a6c-c67f-438d-b569-faa00f73ad52", "value": 1888768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774196528, "uuid": "e3263f17-7fbd-476d-8f37-0ae92151bfc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774196528, "uuid": "6110999a-9caf-426d-9edf-56d2a7917872", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5822aaed-260e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774197847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774197847, "uuid": "73ceeef8-08fb-4ecb-a8e9-378d11f50945", "comment": "Malware payload (Mirai)", "value": "2ffbb51605fbfa4fb39405bb63b61794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774197847, "uuid": "83bfddfb-ecb5-40f2-b3d1-393e8d0ca36e", "comment": "Malware payload (Mirai)", "value": "a5ad829d0667eb351f56cee35119b9fbfb5f4e835a6f2240ccf2ae4264de08c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774197847, "uuid": "6c9adab6-2e6a-42de-a406-59ce5f7a031b", "comment": "Malware payload (Mirai)", "value": "ff274c837be01cc76f4198e4f46c4d9d5df8f4b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774197847, "uuid": "af884e3e-0bda-490d-8dbd-9341833c027e", "comment": "Malware payload (Mirai)", "value": "b93e69520cf07992deb7ca93e3ef52bdfc8347352597b85827a3ce5056883c1d37e0b37631f10ccc6fe887348e44e8a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774197847, "uuid": "a8196a0a-e598-4c38-a96b-527c4037fee2", "value": "T160C36C73E8222F58C594D0B5B0A08F781F5395A1814B5FBE19B3C2B49483D8DFA49BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774197847, "uuid": "e5e14253-6fd9-45b9-885f-a491cb6e03a2", "value": "1536:/1z7j+hmSW2yPbUzDHQs7CDKgCLh7Q/qpxZJOWkrGtBUVM9Q2Uhf:/1z9SWJUfws77gn/q/OWcGtaJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774197847, "uuid": "db2c82a7-4e00-4898-9c7d-9fccdf2f8582", "value": 129312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774197847, "uuid": "d7109c56-2fb3-48d3-978a-af634f7b395d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774197847, "uuid": "520a416b-823e-4c54-bbfc-34a3da54bfd6", "value": "r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0c2322-2637-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774215466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774215466, "uuid": "4793bb66-b2ae-4491-906d-fa2b3e93c95f", "comment": "Malware payload", "value": "199918f0429a9fa1d54c29a97152ec3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774215466, "uuid": "d0947312-6393-4d2f-a145-d95df8b7bead", "comment": "Malware payload", "value": "a6b8e1e4bc98151e86b59c8e5f0c49e9da028703d1671e11310ad9716877f177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774215466, "uuid": "4e30e24e-2fa1-4c76-b629-a97b5d35904b", "comment": "Malware payload", "value": "138286d6f42df41babe6a4c5afad01e3b8ab77c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774215466, "uuid": "fefac6ef-52ea-4016-9393-5c358cb69d4a", "comment": "Malware payload", "value": "9f9ec154b756a9602e5d0e682c34d54028cf7b8e199ebe2a62edf1b0a233166603068b5e1f37eb740ca767eb8d233aeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774215466, "uuid": "01cfffab-4dfb-478a-8ecd-4b8e1fe2f430", "value": "T1F7D6335A2DCF1CEAC4C11470973B69E623B3D9F549868C39B6C13585B1F2FB6302A687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774215466, "uuid": "b9b1f927-5c0d-436a-b4c9-c2f0af48f07a", "value": "c8fda3b55e4040ba39dbeb455bda13b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774215466, "uuid": "a5986e03-fa88-44c5-b591-f5efa29abd90", "value": "196608:AKjxObRM6rmSbXCu0vL+TIM5EACrreaxIXjkHpslo05D4Fc:AOOba6rmSbSu0vL+TIY9CrqPU90l4Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774215466, "uuid": "649df6d7-951f-4c6b-aad1-178772ad1086", "value": 12825088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774215466, "uuid": "37e19bf9-c589-4e70-a4c8-742bb6acd720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774215466, "uuid": "cf0bb5c6-be77-4ac5-b19e-1450b1367368", "value": "play.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a14c233-260b-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774196481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774196481, "uuid": "6a58b800-ac3c-40bb-bd7f-c4743aa39c24", "comment": "Malware payload (LummaStealer)", "value": "055d15afb2c4e739d8f5b849da104ebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774196481, "uuid": "e9cdf6bb-f7d0-4d3f-b89e-64bf2dee3ad9", "comment": "Malware payload (LummaStealer)", "value": "a766439ccc27291e1200b9475b006bdac6e92c5db66b92fdad1fc2e942dec9d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774196481, "uuid": "aa904881-2411-4d57-83f5-fd6f8f17cde4", "comment": "Malware payload (LummaStealer)", "value": "0c24b780fbebe292d51ea93bf14591570888763d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774196481, "uuid": "6321f11b-be53-4b89-9b45-bad6e4ec7b95", "comment": "Malware payload (LummaStealer)", "value": "30a032dec602f312436302e7a7cfd299d5f0c386b5cd5177a11106c708399bca4ab3e5d92afea0529bf0a093cf475dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774196481, "uuid": "2d6ca41e-80f1-42da-b4a9-d71ebc78623c", "value": "T170A46D92DAB258E6D88E1B7C74B2523F8D60773542394D634AD0E99F199FAD2003DF32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774196481, "uuid": "ec95010e-b79f-441a-a5d0-2e2a2b12e110", "value": "bfbf2530b1d1b3e61ef89da2e2906119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774196481, "uuid": "7eec2596-6d49-481b-b07c-b5678d4b794c", "value": "6144:bQ0P45I4QKcy+BQiZMP/jyETFJN3JicJEJ1JEJCJEJ4JEJKJEJSJEJgJEJZ:145yOSUFYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774196481, "uuid": "42e63427-36cb-468e-ad2c-9357f302ad5b", "value": 470056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774196481, "uuid": "9db48fb1-35a7-4011-8d6b-8d02eeac3801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774196481, "uuid": "a1131f4d-be99-4da7-a262-dec41827e029", "value": "a766439ccc27291e1200b9475b006bdac6e92c5db66b92fdad1fc2e942dec9d8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc71539-259a-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1774148172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774148172, "uuid": "45886c1f-660c-44fc-8e77-72d765705c39", "comment": "Malware payload (Hajime)", "value": "e3d547bd6b3e194c104f59d012fe295a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774148172, "uuid": "03d7bae1-dc77-4e96-8bdb-f8c4c3c85431", "comment": "Malware payload (Hajime)", "value": "a8f35a473cce881a9663399251eb8ec59f3260fbf409e2997f1d93612fd45f37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774148172, "uuid": "31daff5c-a928-4c55-ae34-b25a0852680d", "comment": "Malware payload (Hajime)", "value": "2943582ede8f9407cd4a2caa7294c2b9be2b29d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774148172, "uuid": "0db56974-f1cc-4cae-9a2b-85a1a31d2602", "comment": "Malware payload (Hajime)", "value": "10d5aab601c3eab5874e77bbf2e4dba0464c958526aa3cde8c2ae0ed4f00df660fc811e9653ec47d9157eb99d8214912", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774148172, "uuid": "beef0263-daa8-4dcc-917d-a62e6a139c35", "value": "T1C2A2E14627983743E46255F5F37DBF89B2026DACAB7F581750592133607311B6608CBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774148172, "uuid": "cbe3f038-bb2e-4b91-b558-6c33b37be2cf", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBOo3g1qsI:YTYIDfYG6ZmewZ59+Nw1qsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774148172, "uuid": "b9548d87-f005-410f-bfc7-e93206a41b8f", "value": 21568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774148172, "uuid": "3bff2efb-7b20-4a33-8152-66e2c1793c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774148172, "uuid": "88c608bf-a224-44b8-b063-5b296cc8a94f", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9958bf-25f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774186926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774186926, "uuid": "f218f542-120c-4b7e-8673-47eb2a9ce156", "comment": "Malware payload (Mirai)", "value": "680dabdc9e942d2652b1011e2da6135a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774186926, "uuid": "fe05835e-5d3e-49dd-92f2-b1e8eae3981f", "comment": "Malware payload (Mirai)", "value": "ac30ab7740e40135787025eb26fe79edc027a8baa26bbbabaa4c76e40e71e413", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774186926, "uuid": "af381030-d2ec-4c16-bc87-cd99693a2cf3", "comment": "Malware payload (Mirai)", "value": "86e84037b4a05d1fd1161a2408e676934355e3a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774186926, "uuid": "722f3eb3-d945-4887-a652-c27f5617da84", "comment": "Malware payload (Mirai)", "value": "a39171b5d6f177a46cb14b73fac84460842ed650684b87c0e86d80717c04b2c941f635266e99c3a565d5964b9687d753", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774186926, "uuid": "14d5331c-fb52-4fc4-9a00-d434d936aa06", "value": "T193B31A05731C0947D2633EF43A3F67E0D3EF9A9121E4F644294FAA8992B1E325585ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774186926, "uuid": "efa06d80-f4bf-4bfc-b655-8ae3bceacdcb", "value": "1536:DLRN5A4rhT4HGwuB0EUEyxbuyeP1DIVUWnLyXebpijFd2CvA0xPi6UZuuHqQegmd:DLRk+J4lEyxbeDpzewjFo7KYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774186926, "uuid": "ce44952c-a0ed-4b62-bfc3-5a93c2632d9d", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774186926, "uuid": "c94477d7-fff0-4726-9e99-7882a2238031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774186926, "uuid": "7019e96c-b486-4565-ad27-2152e849e501", "value": "e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcace8b-258a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774141056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774141056, "uuid": "102e2a73-7fd5-4000-9c43-999e82c77159", "comment": "Malware payload", "value": "0a8286d29029d71f88ed7200e4c4afd3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774141056, "uuid": "2525b297-6e0f-4ce3-b7c0-5607c2b89545", "comment": "Malware payload", "value": "acb9730b28fdc0753562880d2a3887005b113d45a3f9e847e0fe1b9184f81a2a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774141056, "uuid": "d4bccfb4-24e1-4f71-a08f-b02a0f364746", "comment": "Malware payload", "value": "92932b9307df1587d5575f7771736f13f6bdc85d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774141056, "uuid": "496a1937-5501-4b75-b63e-36fe5a2b82cc", "comment": "Malware payload", "value": "44347a5f49ff79986f9d3de314e077896eddeab33aed45a021f9da6674f6c413de0b5ae26ead3b59e37bdcdc4801cbee", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774141056, "uuid": "e34793ba-1732-462b-8be8-829d4ff9bd4b", "value": "T1DEB6BF56E2F900E8D5BBC0B8C6575517EBB1345917309BEB56A08A692F33FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774141056, "uuid": "49da950c-fcb6-4dc7-834d-16ad9e2e9314", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774141056, "uuid": "2b1efa75-0c02-4f8c-b3c4-d2ec08df6758", "value": "98304:E6z685EAyPeNkrKIQyKQcvS45Lhkebba5GjUt+pL5IMmkflhW6BOxkfICv:nzp5XkrKI1dc95LhNG5GC+p9Iiixkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774141056, "uuid": "af468e11-a498-4388-9bad-e62da932f6f4", "value": 11396963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774141056, "uuid": "de16630e-ee36-49ea-8d48-9f7e5057f9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774141056, "uuid": "69ba35fd-8db5-47f0-82d8-11556695d6a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18bf88f-259d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774149464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774149464, "uuid": "01a2fa10-c314-486a-860b-f46f94e46f0a", "comment": "Malware payload", "value": "59a24b7b1584edbe65d5db8362155014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774149464, "uuid": "7b3cad8d-11be-49b1-ae29-897525787c32", "comment": "Malware payload", "value": "acff01c84493db79258b2b6f7ca4e0f1503ba35dd7d5f233be32106b552ef96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774149464, "uuid": "a27e1ad2-7cbc-471f-bb94-b9de455ab0fa", "comment": "Malware payload", "value": "a4638f8ab585ea844f73a0fdaa9e5ab922194b99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774149464, "uuid": "e16df41a-1cf7-49f2-b47d-d098efa27c6c", "comment": "Malware payload", "value": "d16712a4d3c9552ccae5ff9fe6fd8380317cd52c10a5b6a92c2b05b1e890fe611c54cb26719c9bfa983e779030e46ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false }, { "name": "Zoom", "colour": "#742151", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774149464, "uuid": "2df5190d-5ccc-4e3b-aed3-5fcf37980c0f", "value": "T1A5A64B07E8A644E8D1EED53085369A72BB707C481B2027D72BA0F7682F73BD16E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774149464, "uuid": "d4429555-0abc-4b62-bda0-ee08e3844859", "value": "6c226f77d41d0fd5da242f6fd374f93b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774149464, "uuid": "a1f097fc-592c-4484-86b2-6fbb83894eae", "value": "98304:DCyhFDldeM4ibBdUCJsbEmnDeD3JDiUhivvFHdE1LLvG:DCyPGM4itdUdbDDeNDJAEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774149464, "uuid": "606f93c3-6fbd-474e-8ddf-ccdffaa5ca20", "value": 10421248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774149464, "uuid": "0a8277fe-36af-4a58-a6db-d842e157826d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774149464, "uuid": "525d2136-7678-4ded-bbdd-de21158b45bb", "value": "ZoomInstallerx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04949105-25e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774177950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177950, "uuid": "a35e34b6-e618-4ad2-b6a9-85962b954f0b", "comment": "Malware payload", "value": "1f97e8ec5fd3df0f45de3f4c69f6e5e1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177950, "uuid": "daecfb9b-c52a-43ba-9b5c-57ac0001f962", "comment": "Malware payload", "value": "ae2a58bc0684dbcd69ae0690f09de74538ce8764a9d21f463f3c1fafd03622c2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177950, "uuid": "506e3137-4888-47ab-87b9-22db6f69f8c1", "comment": "Malware payload", "value": "0f386acf2ca8b2e85488adc96b7af1e45844c83b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177950, "uuid": "dcdbb996-4462-4049-bfd7-b5395d0aee52", "comment": "Malware payload", "value": "7e34ed552c053c53181d4a660ad592ffc2e4c027cf7a366619ab5eb5c40a079ca0b9eabc3aa8bf41eb350ac9b50841ba", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177950, "uuid": "19e29e75-ee66-4660-8854-5d7f780e298a", "value": "T1B945334B0600C620D94B0F30924AE2EBBD3D6E96755A46C561EEBBD81DF3B4193AF0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177950, "uuid": "37b174d9-7c6d-4983-8d67-c4e94787f108", "value": "24576:TYQcO9sadDt4Ip9A5ya0sLoSaVAcmrBLOUb96gMzbFtiAI9cim1xUnk9W:sQSadD+RwsLdaCPNj96gGKbBm1mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774177950, "uuid": "22794bea-9bfc-457a-8c79-f70b8fb45c2e", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774177950, "uuid": "2b5ab4ff-e99a-4b10-b1ff-73e7cdf30e1f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177950, "uuid": "54d71f34-ad0d-4a85-98f9-103eb6d3fda5", "value": "MSTSetup_v16.2.251.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a54e795-25e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774179490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179490, "uuid": "0d1896da-03d0-438c-98d4-22f0e3ae0eb4", "comment": "Malware payload", "value": "469d2746521416a662df7a91d0176d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179490, "uuid": "f0d369d8-9047-43c0-bd3a-6e723c642d09", "comment": "Malware payload", "value": "ae6f0329356265d5c8bab47894627cc9009849aa2a0161d919b34369f94e8146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179490, "uuid": "644302ad-7af5-4ddc-87aa-ff89c2c18824", "comment": "Malware payload", "value": "0dcb7168b86123c99afa63d81c174fbd8ed8e112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179490, "uuid": "f93b5511-0753-47bd-adc0-2c4700fdd520", "comment": "Malware payload", "value": "a84e022b17c9946ce92c7dd3f6f479ae4779c64e40c4928d4007c393495175c0f6ffb43052bf19161deae581534b7401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179490, "uuid": "8f81e035-e498-46b6-81cf-058d8767be0b", "value": "T16B249E9DD763ECE8FE6712B9657119233F42885FA1D9285C208DF6213C3625350ABCBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179490, "uuid": "1e762582-58fe-428b-b193-a1d122f324de", "value": "8b818227cf97f5e64ec2d6c6b583368d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179490, "uuid": "33d0868c-5ebe-4c92-9233-4dade2c4ac67", "value": "1536:r83qEV7VsO5NAY5fLdhI6kLkrsufLioP7eo7KJb3DJMXQFMMtPUNdk1WFFqKXzRj:waEJeO5r1Ldhjkes2GiArJSrFqKXzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774179490, "uuid": "f8aef7d0-793f-4465-97ac-3bed7b850fe5", "value": 214648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774179490, "uuid": "1c565825-c345-457a-ae56-7b4c3b5f6d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179490, "uuid": "abedb2f6-f17c-4a10-8d44-4425d61a81b6", "value": "r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a97cb5-25eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774182668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774182668, "uuid": "723c1635-9f4f-46bf-8230-1309812f0feb", "comment": "Malware payload", "value": "d169d10cb4f8db8791acd8bc0dba29b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774182668, "uuid": "38a0590a-2e07-40fa-aa81-652a7cac4cbd", "comment": "Malware payload", "value": "af2944607c944ed96bc46b74caed3bea624dee465f36b74d776d4d59cdb2d73c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774182668, "uuid": "62507309-d96d-48f0-bf59-fd89d2cbe434", "comment": "Malware payload", "value": "e756816c24ce3cecfcb4f4b70c4b6c05a206f87e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774182668, "uuid": "31bd27c2-5f53-42b3-8bd6-b4ea42976d18", "comment": "Malware payload", "value": "ab1d00fc2b5b355834c3f4b68cf41c8657b131ca8c80afe59e960564e56bc7f2fe26b31429c5aa9276ae9bab73316f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774182668, "uuid": "6fce572a-c86e-4a7d-9f4f-1b95d0dee9c5", "value": "T125B48E01E6805568D1E6B138B87DB33F9871F4187B2555CB33E85B242FE1A80ECBAF65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774182668, "uuid": "cfd76fd0-fd74-4880-92e3-8779395c9592", "value": "194224cf1a583b61bab689008d84c522", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774182668, "uuid": "ab3e32ba-af86-4712-b006-2034631ec75a", "value": "6144:bo+CvMyE+nX+qrqEPjoQInP09/Jjvy7NJUxiZLGG5voTbYVHxtDHdqpgu9Dry6ud:4ZPetu1BzbfVxVHnbUdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774182668, "uuid": "bb9c57af-3067-4409-9f5b-e127c636a476", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774182668, "uuid": "48ff2db1-e6e6-4925-ad5d-f2ed31b9994f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774182668, "uuid": "cce72cb9-218f-41bc-8ead-4c312157dfec", "value": "af2944607c944ed9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c93f54-2611-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1774199155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774199155, "uuid": "2226a76d-3aae-4266-8999-8f45132ceaa7", "comment": "Malware payload (Smoke Loader)", "value": "62cf747035953acede377ffd49a5cd8a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774199155, "uuid": "7d21c472-a7a5-4575-9dc3-de130b1cd4bc", "comment": "Malware payload (Smoke Loader)", "value": "af3330efee44beca6246b042b64de26010971c71a4c551cf806a3d7856079c5f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774199155, "uuid": "b2451128-6644-4663-ba7c-3b1bfb1b91b0", "comment": "Malware payload (Smoke Loader)", "value": "1909e4465caf9cd248dc9c47f0128c9951e1dfdc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774199155, "uuid": "2d0b9c4f-56af-4b4d-93ec-4599c9856b43", "comment": "Malware payload (Smoke Loader)", "value": "edbf6d1f5fd6f6cf18e9c2e24a21986196dbd41334426456c34e54f43aec0b842732c297d1b7f81ec9ce712f424dcac1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774199155, "uuid": "4fe9da46-e615-45b3-9c5d-242b14001d0a", "value": "T19C85490BACE545FAC46AA732C9B26192BB71B8080B3133D32F91B6792F767D09D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774199155, "uuid": "341750c5-84d6-485a-b3c6-9db1d2ca2606", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774199155, "uuid": "c57aafdf-6125-47f0-b173-0cb60fe6118b", "value": "24576:2pEIX2cS0VHepu4Vfv8aacCUDV4ewLtFhele5n92DbA2u:2ptZSdpu4xvPacCUJlkIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774199155, "uuid": "be3d4dd6-56e8-49b9-8210-adb97809b451", "value": 1851536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774199155, "uuid": "08fb2b1d-f589-47f8-b656-97b57cf6d41c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774199155, "uuid": "1860a0e8-da61-4b75-a0a8-577514a6d1ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3484785-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (BlihanStealer)", "timestamp": 1774160687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160687, "uuid": "5c3d552b-0cf7-41fb-958b-e4ab08482c04", "comment": "Malware payload (BlihanStealer)", "value": "370e40b42b790d298cfdcffd36e991c0", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160687, "uuid": "a84a9c71-6c3d-48d4-98a0-b72bd4e9a575", "comment": "Malware payload (BlihanStealer)", "value": "b1d2f130f09ff1f4f275d65e19cf51ad1120c4e2a1e2818fa30bfa6f02d893c5", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160687, "uuid": "5b745b3d-2eb9-4983-8231-99259d919496", "comment": "Malware payload (BlihanStealer)", "value": "2bed3126e6b6cee3290bf6b5a5618328f3ca7021", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160687, "uuid": "456036b9-c87c-4587-9c81-54f5a6c0861c", "comment": "Malware payload (BlihanStealer)", "value": "fbdb98f14664c89166730ccaa61194a659806c9f0af3da3b304978fe1e5312fb31ebd419b50a0e8592774db00a271317", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160687, "uuid": "d080cab3-23f3-40b6-a4f9-997c30199ef3", "value": "T12573E64B4E71CDDBE804143EA7EAA21C86D3FC5418CCE35A57EE984774C291C889ED67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160687, "uuid": "1ebf26e3-1a03-4330-9d76-48d9af57520c", "value": "23d47cbef5ef7b970f550a993e2e8f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160687, "uuid": "f451ed00-ea12-44d3-b78f-10c353278936", "value": "1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrhO:E1oEFlt6vghzwYu7vih9GueIh9j2IoHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160687, "uuid": "832cf848-2aa0-497f-8133-4a3077970cba", "value": 79460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160687, "uuid": "249e9a00-716a-4c43-baef-bd007f5d8a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160687, "uuid": "bcfe13be-772d-4eef-9b4a-7b0af9c7fe52", "value": "virussign.com_370e40b42b790d298cfdcffd36e991c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203d0b4f-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Floxif)", "timestamp": 1774160817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160817, "uuid": "efa4a0cd-9f4c-45c9-83c2-e8e0efbb15dd", "comment": "Malware payload (Floxif)", "value": "27b2f771ee287fb58f24db30e40067d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160817, "uuid": "fc1cb028-5192-43e9-b1fd-0594241bdd0c", "comment": "Malware payload (Floxif)", "value": "b7a478e7776d7f54b9c39bb03b685ab5892d4d802954b08443d5678319c81f76", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160817, "uuid": "19cb84cf-8721-45c3-9a4e-957a43b888c9", "comment": "Malware payload (Floxif)", "value": "48827714eb21f7a0484ded473c0ecd5dce5c231d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160817, "uuid": "c0f3f5ea-bfd0-42b1-b71f-47ffb8f4328f", "comment": "Malware payload (Floxif)", "value": "3385d2ca8a61e8252aed646d25f5c0a52e6ab5d61e3545cdcd961ee6c0cb8f3adf41da024c02ef856e9619a6b579b92d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160817, "uuid": "417b7150-6ea0-42fa-aa1f-25d32e8a372a", "value": "T13DF35B216651C579D59200BA156E177F96BEA933031F10C3A3C05EAA6E309D2EB37F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160817, "uuid": "ac721b04-51da-4cc7-9802-855d01b0b4bd", "value": "cc6707df676bf2856f4ea7f70f359ef1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160817, "uuid": "cf5f5909-a0fe-4439-a154-15a46ba499f0", "value": "3072:oJ8IMILmCa3yx6oFEdgVXnF1P1duA9TSiMNFeya1:bkmCaiEoFEd+FhuAgiMTeya1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160817, "uuid": "e98f1718-123e-4aef-a3ab-a0fa10fc2b9e", "value": 169411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160817, "uuid": "c043b38d-f73a-44ac-b65a-1548dc694d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160817, "uuid": "7a7fda75-bec6-43f9-a6d3-38416a876e31", "value": "virussign.com_75a67d57bb626d827b12b0795cdaaa60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cc52a5-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774160901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160901, "uuid": "213a86c3-fb77-43b4-abbe-c0f7b9697afa", "comment": "Malware payload (Snojan)", "value": "aef5833f818667027194d217695bbd90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160901, "uuid": "0c899f64-0d7c-4bde-8abb-ee24cb949673", "comment": "Malware payload (Snojan)", "value": "ba04e23dd6e8c8cd97b7932a319f33aa55ab905d5e53750846ca474b71b55f88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160901, "uuid": "d4947572-8a38-4cf5-9d6c-aaab95fc0e6b", "comment": "Malware payload (Snojan)", "value": "00f9aa9e6c3af55f7e71294abdb400eaf4a01876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160901, "uuid": "27a19ca6-580b-4da8-9b79-549cf3dde9c2", "comment": "Malware payload (Snojan)", "value": "8842b77262432c910e4edec562fc442df6190ccefe2d2ee7fb62bd3d041c12965e14e21f7a7c402a543534f82dc30086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160901, "uuid": "8d2c6d5f-2860-4d7c-8797-06106f319518", "value": "T1F0345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160901, "uuid": "c3dae80f-035c-4515-9985-5ceb27f794ef", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160901, "uuid": "e485f1a7-424f-4e87-8814-964b3572250b", "value": "3072:SJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/Z/FnncroP9:GwDeM7iNEkgiOb31k1ECFJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160901, "uuid": "e2508484-1344-4d45-92ae-1943c0e73f01", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160901, "uuid": "a38d5c4a-a010-4382-8683-d775029b74d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160901, "uuid": "d94105e8-2e92-4a28-9ab3-14eb4b24675d", "value": "virussign.com_aef5833f818667027194d217695bbd90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce88b96c-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160679, "uuid": "0549626d-ef23-41cc-87bd-07474f659558", "comment": "Malware payload", "value": "96e18f8041dfcdf87b3144b686c5011c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160679, "uuid": "2feb345c-9ad5-4015-902f-217cd2f188a1", "comment": "Malware payload", "value": "bb11a7d3236275bbbd747fce9e04a2d769f1c75a2bac453d2a696cd67befc04c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160679, "uuid": "0c4e5629-2d1f-43d7-a55e-52a28f782499", "comment": "Malware payload", "value": "6cc8685e1ad77f24f099b8048858284e9b880805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160679, "uuid": "1e9fad1b-41be-436c-8bf9-d7f23950f5f5", "comment": "Malware payload", "value": "a4331da7ee94eee951089485cbb2163d0713ba9180ffbdde91b161fe1ef33a9d1888a89d297ea4d9ff9398c72675c7a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160679, "uuid": "91fce4f8-6654-4d37-80b7-914c95b1d20f", "value": "T123F35C5AB386CA85E85A17301C92E3F01667FC451E9B0A9B7194379F383AF13A81DF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160679, "uuid": "ad86bd92-1a2b-484e-9656-f8dd83125c29", "value": "b1510f80830f4a178a3f17763f6ff90a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160679, "uuid": "18be7a59-a710-4390-85ce-597c6868e694", "value": "1536:AswIofF6P3KiDH4BIR9pT7P5DHe4dPpc:AsgFcP1lV7NPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160679, "uuid": "e5d6bf40-0ffd-4fbd-baa3-44355e6369d8", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160679, "uuid": "ca04e3a1-f059-4d30-9ca9-d4fae545825b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160679, "uuid": "31f61dd1-c870-42e3-a7e9-d0a63e4334d6", "value": "virussign.com_239b5810cec4143f86f19ffb73da20f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fade97-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161041, "uuid": "1c938dac-5328-46a7-bd23-450bf8e8c147", "comment": "Malware payload (Berbew)", "value": "d8f5762ac873b7b1d0d02fb4335eb6b0", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161041, "uuid": "5e2765b4-239b-45c9-835e-d1758f535207", "comment": "Malware payload (Berbew)", "value": "bdffb755157cfd5184418218f1ab2c5115ea50e09efeeebed9f211c2e957b490", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161041, "uuid": "cc32bd60-163f-4610-828e-0afa0eac61a9", "comment": "Malware payload (Berbew)", "value": "ed854d8d902e2433c7de9546156dd26dd3e66768", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161041, "uuid": "4ec07504-a0cc-4f21-a8bf-8c2c77311b1d", "comment": "Malware payload (Berbew)", "value": "9adedf233ee014664317f97517b470e3d204b692a006f992a1bafc15fdf5b13cce3c5b1b3642f758cfc49f4728b1a785", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161041, "uuid": "b72af252-7b0d-4273-af91-1bd1c4664248", "value": "T17E857D1754759FAFF08D573F12722695F8B043EC3AB68B19AE70C68B1A3258EC49CB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161041, "uuid": "8ad1ecd4-955c-43bf-9d5e-95178ae78fd2", "value": "3235d0a66c0a8ca4d8b84f3bea439dce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161041, "uuid": "a2826834-0b43-47c5-984a-5136c8c5b472", "value": "49152:nix7/ix7yix7/ix7Xcix7/ix7yix7/ix7Y:nU/UyU/UXcU/UyU/UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161041, "uuid": "35e5b215-6067-42e8-aa14-89b238925e42", "value": 1802280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161041, "uuid": "881794d9-be7f-444b-b8f1-172a753c8c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161041, "uuid": "6f64f640-e5e7-4608-a776-bc1c87c9bcbc", "value": "virussign.com_d8f5762ac873b7b1d0d02fb4335eb6b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc30dae-25d0-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774171416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774171416, "uuid": "5c0d52a1-9ab3-445f-877a-129af8372129", "comment": "Malware payload (QuasarRAT)", "value": "a1e18fed4561874a83fda9718abef101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774171416, "uuid": "b14f83d0-d29f-457b-9c20-f5a98470e8a6", "comment": "Malware payload (QuasarRAT)", "value": "be27cc8b9ca1d80e2383b152992eff38dc18f41c182ad42cfbf7707407fb9e3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774171416, "uuid": "c332856b-7a65-47eb-a0f4-d4b92ca1036d", "comment": "Malware payload (QuasarRAT)", "value": "964094540124c5bf1daa2ba539cbc992ddb3ac36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774171416, "uuid": "99e530e2-a033-4ef5-adb5-ea51b30a7bf5", "comment": "Malware payload (QuasarRAT)", "value": "94c04999a4924b8e1c3744548b6430c98e2bbfb1e7ba825bc39c72d14e9d3424ad115a8881ef0bca89e4a808984a53d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774171416, "uuid": "415cffe5-3207-464b-b4ce-01c13086ee5a", "value": "T10EC5011177F9810AE3BF1BB5ABB2145D1BB7B903DA7AD78E1848905D0EA3740DE503A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774171416, "uuid": "9be5f6cb-1a56-4ff1-afaf-67497a9ed324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774171416, "uuid": "bcaba102-f45c-42e4-940e-6367ab2c3be1", "value": "49152:PoDVQiNgLmnc/N+ZZXZQOLHM7wRPirm2NnPTKKm77LrwCB6uanWk:ADVfNgScVIxpL7oZNn2Km77LrwkFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774171416, "uuid": "fda119a9-f372-4752-87ca-ad32953142aa", "value": 2710528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774171416, "uuid": "2e680de5-9473-42e9-a4b6-9ebf9d6ffae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774171416, "uuid": "800cad67-e38f-420b-a886-264211f5dac7", "value": "svhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9134ea-25a1-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774150957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774150957, "uuid": "19256414-5666-4cdc-ac97-e3c264a07bb8", "comment": "Malware payload (RatonRAT)", "value": "47f4c65a561516736c211edd466524a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NotePad", "colour": "#AAC867", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774150957, "uuid": "4315040a-1f89-4627-92a1-2411257add44", "comment": "Malware payload (RatonRAT)", "value": "bf47fcdff4292e8b888e25d14e731f604267f82f1a05fa41607f990ab9289e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NotePad", "colour": "#AAC867", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774150957, "uuid": "2572e38e-8594-4e21-9660-d6ca6ad74e29", "comment": "Malware payload (RatonRAT)", "value": "daedd32456895d2c81db688d4ee4fcb8ea36abcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NotePad", "colour": "#AAC867", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774150957, "uuid": "ae16f0e0-9509-453b-a541-61c2082fd81c", "comment": "Malware payload (RatonRAT)", "value": "0342ceaa21c245a38159aead87a2fcf958f8b150cba5c2501f06526b45cdbf78c22e385dd574a1faebed2eeb49bb42b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NotePad", "colour": "#AAC867", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774150957, "uuid": "69f2fe98-e395-417d-91fe-ca0f04900070", "value": "T1AF934C0073FD612AE6BF8BBD697625088F727917AE35F64D4C4690AC0970B81AD10F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774150957, "uuid": "e4a35f76-68d1-4d53-ba91-f8844a972bd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774150957, "uuid": "795ffa03-f3f7-46ed-b2f6-f06dd8923b91", "value": "1536:Hr/cBiqEH5ySb9CJqlnzTsqa4tsi5Rj50Elb+KvCl1slj:HDcYNHnzAX4tnDt0Elb+KKl1Sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774150957, "uuid": "e95c3e13-246d-4075-b681-250b88fa70ed", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774150957, "uuid": "31fe3589-7c9e-4cad-b710-3344045f12ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774150957, "uuid": "9f9efe8f-6a9b-4d56-a287-c01330adaae3", "value": "notepads.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3698738a-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Cycbot)", "timestamp": 1774160854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160854, "uuid": "5ab483c2-d65c-4e6d-a837-c34ccacc535c", "comment": "Malware payload (Cycbot)", "value": "aa689b6ecc121f1cacf7e4a632957e80", "object_relation": "md5", "Tag": [ { "name": "Cycbot", "colour": "#6F834E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160854, "uuid": "06b3f34d-15f8-436e-b076-4e4e1bd7a094", "comment": "Malware payload (Cycbot)", "value": "bfe53a0250e212f6bd1bc1493dd6a0eb622a1ac260e8e69c51f48f4d9b71106d", "object_relation": "sha256", "Tag": [ { "name": "Cycbot", "colour": "#6F834E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160854, "uuid": "f64bab3b-8542-4068-ae2c-19006481778f", "comment": "Malware payload (Cycbot)", "value": "eba51312d764cd003bdcf53cf5065ba22a014ef4", "object_relation": "sha1", "Tag": [ { "name": "Cycbot", "colour": "#6F834E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160854, "uuid": "22528c7a-5cbd-4648-9bae-acb3754e3fb1", "comment": "Malware payload (Cycbot)", "value": "5b90b7e727c179082fb16382a871aaae0f0a5aaa0b676060ddf69144554b3c112f38a53fb93c847f073b51faff311ce9", "object_relation": "sha3-384", "Tag": [ { "name": "Cycbot", "colour": "#6F834E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160854, "uuid": "d42daa26-bddb-4f08-a0eb-9a39d384d4a7", "value": "T10AF3026745689859E2F1E238395BD2B83B4D10B2C3886CDF6E8406FA736195FCA417F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160854, "uuid": "70b5fc7f-0914-4f25-9167-41979b0a157d", "value": "f1f4a5717ceb0d877e0bb9d930b6b360", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160854, "uuid": "50970da0-1a0c-488d-ad6d-150a9eeb8cd0", "value": "3072:lHmjLNF9utk0WVJTuZ3E6xPVDdyNysC+L/pSU/yJGbZbkSWeZgFOsl:4LNF4tk0WV1AE6NBd380Ynv9iF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160854, "uuid": "52506d4c-a70d-4120-8ffc-482a6ca80823", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160854, "uuid": "22558b74-b4d3-4920-b291-7c525c6b1a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160854, "uuid": "2618156d-1c37-4a53-8f3f-dd7135c61471", "value": "virussign.com_aa689b6ecc121f1cacf7e4a632957e80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c68c13-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208975, "uuid": "bc81d311-ea57-4ebd-92ba-aec0528c857f", "comment": "Malware payload (Mirai)", "value": "ef91e7e5f2eb8e31895ba9ef3e0c6e6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208975, "uuid": "1c1dfb08-2621-41ba-9072-7bc3aaadecc2", "comment": "Malware payload (Mirai)", "value": "c031158e151eb44a8274a09628409f4ca1e6800796846e765b04ec236b458595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208975, "uuid": "22150076-9e42-4a10-9445-c4783ba4083a", "comment": "Malware payload (Mirai)", "value": "1bd4ae8c780e32fad882dc8f19811e1e15a6a634", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208975, "uuid": "9bde3934-d76b-4231-b7f7-5329c4388e23", "comment": "Malware payload (Mirai)", "value": "3e71abad37f0d60cf3098cf9fd0eb59c6ca895e58befdefa25b508993ebfa1a56b37701293b44f55b1a28fe01100a8e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208975, "uuid": "50f142c6-029f-4a61-bc73-ba3aa25418bd", "value": "T109D3C74E3E318F7DF7A8C2344BB74A21A75923D526F1C541D69CDA012E6038E646FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208975, "uuid": "7448b8fd-4ac2-4cfc-b262-5e7360eb6fac", "value": "3072:PN6oqeGJTl1zyYl79ovM2eQWr6f8CDLwkT5E0:coqeGJTllN+vM2eQW+x3wU5E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208975, "uuid": "b4b20391-ec09-4aed-98a5-225bf2f8605b", "value": 134020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208975, "uuid": "2cf26d39-a6a3-4276-909c-ab10f754680a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208975, "uuid": "0bb5ac02-3f22-4755-be28-46904e0053d5", "value": "tux.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c12af2e-2588-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774140328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774140328, "uuid": "39fcffa0-fc1b-4b88-8646-29be8995bdaa", "comment": "Malware payload (Vidar)", "value": "a295ccd7467ae50f3931a443262069e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774140328, "uuid": "e4ce3ac7-6e9f-4701-85f1-89d35b386d86", "comment": "Malware payload (Vidar)", "value": "c2272a25ff99b5bcb5eac916df6e5c612ccc8d1b29c6a45c40e01dad4a5015fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774140328, "uuid": "ba1dc024-6eb4-4cab-ac5d-45e689f2d768", "comment": "Malware payload (Vidar)", "value": "941a8d34f29ec5c3990af8e70df5a61680df405f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774140328, "uuid": "c62e43af-7831-4dcc-89f9-39ec3de87496", "comment": "Malware payload (Vidar)", "value": "3dbba54e76c33395969a98dbfa6bf260555319b1124ebc7fbbfac640c8a431a5170e594c960044dbae5b8382b571fc62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774140328, "uuid": "6ba9700d-3b4a-438e-9d34-6d6ba1dd2ca8", "value": "T1E196D52B31A48228C24D81FECFE28E40D4F3757BD72385EB46AF13587A15BC59DBA560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774140328, "uuid": "6ffa91fa-b2eb-4013-ac0a-94bed9c5ff27", "value": "3ddebb65c2eb980f7e40797e62c34d3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774140328, "uuid": "27acd884-7b5c-41e0-b435-204b4f559a72", "value": "49152:+Ipabd5kc+rOhiMj7g5Fh+uuddlS4hwo+MVhRBPO3X8Q0KHAGCGLkv3AMbjsEY:OH3OH81KHfUNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774140328, "uuid": "a3cbcc7b-ed26-448d-ac9f-0bdb626688c3", "value": 8887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774140328, "uuid": "80f7652f-deea-443f-a80b-f2b0784affce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774140328, "uuid": "2f448613-f6df-418e-9792-a375a27542e7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.16212394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff651bfc-2596-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774146588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774146588, "uuid": "7cc15d07-405b-47f5-9e0f-40b5aa13ac22", "comment": "Malware payload (NirCmd)", "value": "2cc2d662a753da9b2692861f45c5827f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774146588, "uuid": "e8d21f8d-ca87-4ad1-b3f0-e4385683a152", "comment": "Malware payload (NirCmd)", "value": "c722ac56a88be3eac5bc0221c191259f885097f5b4645da42fb736668b871f39", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774146588, "uuid": "4b40f18b-c2ab-4c7e-b0fb-1509977965e5", "comment": "Malware payload (NirCmd)", "value": "75c2fe317a3775915f0622a38442e05688623dab", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774146588, "uuid": "fc14a3f4-06a2-4f8e-91a1-f1a8b56f6e8d", "comment": "Malware payload (NirCmd)", "value": "72379beb6a781bf65276e5cc24cf46a61a312db14b7076a0cc62afe59329c75d5ba07b97b1528094578fcad839163b49", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774146588, "uuid": "a178b2d1-43d0-452b-90d5-c76f6d4434e4", "value": "T177A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774146588, "uuid": "2280bd03-828c-4089-b509-07de54977393", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774146588, "uuid": "45e50b69-9cad-4c1b-ba98-85d5e5a3e8a2", "value": "49152:ABRqTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a4TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774146588, "uuid": "d462f8cb-faae-43cd-ac89-55409801ddcc", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774146588, "uuid": "f1055192-8d7b-4425-a33c-54b84c466c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774146588, "uuid": "83dddd6b-bb0a-4391-b0e7-2c4be09da758", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3b506d-25dc-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774176619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774176619, "uuid": "f26a0b43-011c-4a87-b88f-e38a87730376", "comment": "Malware payload (RatonRAT)", "value": "4602e6173d928d8cecfddda6ee610a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774176619, "uuid": "37e3f3c0-affc-4f31-935c-d3d6bea7d49b", "comment": "Malware payload (RatonRAT)", "value": "c7d57e221b4a2d6410c83b35d31d2d790dc5489dc82ec947807954f723d9a564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774176619, "uuid": "be5d4fd8-df0d-4eb1-831f-77e7e258a99b", "comment": "Malware payload (RatonRAT)", "value": "570ef42846558c9dcc78a937260f66c62fa99278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774176619, "uuid": "3335b2f5-3fc1-4ab0-9c95-b4a4a15fd8d0", "comment": "Malware payload (RatonRAT)", "value": "1a82f961888e4727daf9ae9172866dd8c6e951adce9f33ceae989f5212daa057320b9cece12411e8c2c6e6989acdf7a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774176619, "uuid": "19f9cf54-21d2-4c77-b391-7c7f24a091a5", "value": "T18D935B0033FC6929F6BF8B7C58B464054A7379675D31E68D988AA08C1AB1785DE20F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774176619, "uuid": "83b106cc-390d-4d12-80fe-0bdb6a01ff36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774176619, "uuid": "83c43bec-bc14-4316-9d27-c0848223ac19", "value": "1536:BjiJJ1bT5afM21VOdTsqa4tsi5ZO9x5pclbNKpKC6bsrxI:BGJxT5MaAX4tnfEpclbNKX6bmxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774176619, "uuid": "7544133c-fa95-4222-95c3-af780d401188", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774176619, "uuid": "6bf6d9bb-08cc-4d86-8bc4-47b75a4584ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774176619, "uuid": "0d6d8548-adf2-49ba-b5d5-02fc9468fbee", "value": "1121212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ecfff5-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Floxif)", "timestamp": 1774160767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160767, "uuid": "cb15b4d7-4fb3-4d04-9024-697657c0c103", "comment": "Malware payload (Floxif)", "value": "75a67d57bb626d827b12b0795cdaaa60", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160767, "uuid": "878c19cc-a83c-40ea-bdfa-21010dafe799", "comment": "Malware payload (Floxif)", "value": "c8082b6b6e3f681fefa98762c23a8dc2895e6e56eeba56a2b0e7dba3d3b2c154", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160767, "uuid": "30fba2a7-20c7-4d9e-9f31-310e0337fcd6", "comment": "Malware payload (Floxif)", "value": "d98290e6e6c03c2e35f9a0d220c053b43d72b6d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160767, "uuid": "4c6e7fc0-7504-4a71-9062-535d8bc0e3d6", "comment": "Malware payload (Floxif)", "value": "c1add109ec4aeddd3035d058d180bf2088fe294fc312f65c8b3715371e3c5cf85aadede999be100595b63e26d4ac5fcc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160767, "uuid": "c0fa2502-c10f-44fc-b4e2-9a0a4ca77ba7", "value": "T11973E1332AB44079CF323F37855F93AEB7B5D5621C70642B86951BA48CB4DD0E22366E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160767, "uuid": "7f9fff6f-1347-4692-8845-9aa3671a6073", "value": "2f4ddcfebbcad3bacadc879747151f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160767, "uuid": "a106d2fc-1107-4d12-a49a-abee39560035", "value": "1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZpF7yya1:c8y93KQjy7G55riF1cMo03HFeya1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160767, "uuid": "93f50cfc-f989-465d-b4d5-a5d9a52e6e35", "value": 78275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160767, "uuid": "67eb31af-2b87-413b-8395-73b97771996e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160767, "uuid": "e7cf63ff-fe7d-452b-81fa-23618ad19134", "value": "virussign.com_75a67d57bb626d827b12b0795cdaaa60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3224d7e6-25f0-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774184898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184898, "uuid": "301e84ab-0b4f-4af1-ab20-afeb43c579b9", "comment": "Malware payload (FlyAgent)", "value": "2674bcf8e61a1e9ba32133cd20d2f070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184898, "uuid": "0311a85d-d89f-498e-a5bc-2f55eea9c584", "comment": "Malware payload (FlyAgent)", "value": "c97dd7d1c7415789383ebc30741cc860eefeb03a1363637a29999c5ec5a1e876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184898, "uuid": "2a8c3883-a5db-4f5b-b89b-7c6b2ded3ca7", "comment": "Malware payload (FlyAgent)", "value": "597b4b7421d61c77a496952514508969732d342d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774184898, "uuid": "6b33687d-45e7-49a3-a827-306d94eb123a", "comment": "Malware payload (FlyAgent)", "value": "11ce7aaf23b5b7f5e4f96ab182de0236764e75a15d950fa1d93ee57a0a8d7d55613c4c1308588f8933784b93bb6ca7ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184898, "uuid": "7454ff66-7712-428a-b28f-ce8be3392bd5", "value": "T12B458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184898, "uuid": "30f72553-bc7e-42a4-b09d-c9f5f872f82f", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184898, "uuid": "5bdb35aa-edd4-4011-af1e-b35ce6d1ebb3", "value": "24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QW:acallSllG4ZM7QzMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774184898, "uuid": "49582f7d-9488-4cb9-8fde-1e3ea22e074c", "value": 1174407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774184898, "uuid": "e18e1f3b-2ffe-4485-92d1-83a977a6d3bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774184898, "uuid": "e92394ce-bd97-4129-ae81-2122b2f38293", "value": "c97dd7d1c7415789383ebc30741cc860eefeb03a1363637a29999c5ec5a1e876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd6bb56-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161135, "uuid": "f2275f03-ca42-4a2b-91d3-153f6b88f495", "comment": "Malware payload (Berbew)", "value": "f7fb4aa203764d61b52080ac38a2a9c0", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161135, "uuid": "a196bdb0-7c35-4ce5-ba3c-876cd6768d04", "comment": "Malware payload (Berbew)", "value": "cb3c27c07347120395212a72516e708891c2620d92a2f48bcf84b71523deb506", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161135, "uuid": "407bb54a-0895-4f90-9a4d-d47384e29f70", "comment": "Malware payload (Berbew)", "value": "01ac4e790d96ed5c28b226fa671fb36597cd678f", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161135, "uuid": "037fad65-52e2-45b6-8c62-9b9f3803c1af", "comment": "Malware payload (Berbew)", "value": "323a37f3589cae27034640b6b52a9e8342ab8a21021ac3a88d3660cdda7341497c3ee914ed6c6039cbc5a475fa043a0a", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161135, "uuid": "565535b4-48ad-4e2f-be9d-0b54bf978e83", "value": "T1DD93AE3698B40EDAC580DF3043BCF9B3395471B691A049068F7B9ACA895BB0DBD34DD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161135, "uuid": "4c9d380e-1c22-4a07-bea5-08c879269f95", "value": "73bd81c5b63ac89a8b9ee1b9e71a8a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161135, "uuid": "89279a9f-1174-4386-b1ac-89b37128a0a7", "value": "1536:rL8DOAHyjCuzpvW9xO7gHRmyg/AgfOn20YzGriD9yjbbbMXCilkZ+xH:rwDuCu1u9agHRmyg/AgfOn20YzGriDiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161135, "uuid": "ce78a7c4-c0fd-4593-a42f-974d97ea2aaa", "value": 90128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161135, "uuid": "cf8f5c65-0cb0-48fe-8661-4f7ceacccf73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161135, "uuid": "d3ca06e8-8647-4ed7-9ec8-ec7a2ab1639f", "value": "virussign.com_f7fb4aa203764d61b52080ac38a2a9c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4908596b-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208989, "uuid": "118a5bdc-2844-4d5b-a2bd-c7de8fb70008", "comment": "Malware payload (Mirai)", "value": "19ac4e29de7a372af16ba64e9f5cc833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208989, "uuid": "c49e52cf-3327-416c-af85-fd0a24a4651e", "comment": "Malware payload (Mirai)", "value": "ce86f67220e57e39fe2cf009b28c45742e371ab3a5445cf304af0c29a6c5c8ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208989, "uuid": "bd82af43-14eb-42b8-901f-3d4d6423c457", "comment": "Malware payload (Mirai)", "value": "f6b0232152afd3528938470eec8f579dc02dd329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208989, "uuid": "5425b7d2-f82e-4455-b6fd-1ba902b743cb", "comment": "Malware payload (Mirai)", "value": "dd89d6d4278dc4a429a50d5b256b87a025c546ec820c72fd72fb4bc17782f5b89b380347f81494c46f1edfa5145204d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208989, "uuid": "0828beae-a02c-4698-95b6-3368b1194c58", "value": "T172836CC5A683F8F5DC2606B930379B738A77F5369038DB82C798A837AC51A40E51736D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208989, "uuid": "86ef3d61-28f4-4de2-b328-db464973e442", "value": "1536:nrgsS9Nw9e/tWvP/ICvNAEb2Ih6+BrrctDDOgKAB5kc4YgMsU1o6Ltrv0bPbCkvn:L+4e/tWnwYNAE9d1GDOgLB5V4pRU1fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208989, "uuid": "f0c431fb-b5b7-48ce-8fe7-63937bb5cdde", "value": 87568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208989, "uuid": "1ea5bf96-2076-4bd6-87fe-6d890099ce03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208989, "uuid": "a0c38408-a91a-49b4-9d19-776bd2d975e1", "value": "tux.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12cf494-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Yunsip)", "timestamp": 1774161167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161167, "uuid": "18649a99-54db-45b6-92e2-4db8506f2da1", "comment": "Malware payload (Yunsip)", "value": "fda284ba2999606d61acb9842ce92080", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Yunsip", "colour": "#BFD13B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161167, "uuid": "55ca7924-a7f7-46e2-9324-69a18456e31d", "comment": "Malware payload (Yunsip)", "value": "cf363f44fb75c84ba52264bfed96d54a4c6a1376aab75e38e8f2b6973db18e93", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Yunsip", "colour": "#BFD13B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161167, "uuid": "09562580-ac09-4710-af45-73c00a67eedc", "comment": "Malware payload (Yunsip)", "value": "3253782675c68dd5cf9485cfed9e290010812e78", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Yunsip", "colour": "#BFD13B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161167, "uuid": "a1919fac-5909-4189-8e6d-ae0bde51ef83", "comment": "Malware payload (Yunsip)", "value": "ab973a2eb8afedc5262c487ee334ed43beda961d98d050ccab24f4eff1df070ea82418f2d30745f22513ff044010b235", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Yunsip", "colour": "#BFD13B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161167, "uuid": "112e1a16-8b1b-49dd-8c46-6b6712031da9", "value": "T1572517E125D870EBE6F3183A4165B767FF56AE72BDC88617425A0ECCC031C47BAE1981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161167, "uuid": "111a5266-6749-4879-a8fd-974f209906dc", "value": "1e1223274bdbcd9e9b18e120e4c501f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161167, "uuid": "91ac8a2a-96bc-44ca-8673-f1167cd4d736", "value": "3072:o6pU5Y1DXnbMn7Uzkop61/dAzV2O3XwTBftrm2YedGf3QKZDP:o6C5AXbMn7UI1FoV2gwTBlrIckPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161167, "uuid": "e233d275-d4be-4baf-85de-5aba884f0bff", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161167, "uuid": "a6fd2862-9748-4610-b2f5-bb5b9fe7fead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161167, "uuid": "f988a49e-e73a-4e72-a32b-ae7d1e17a952", "value": "virussign.com_fda284ba2999606d61acb9842ce92080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a52362-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1774160710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160710, "uuid": "af18b2b2-7850-4199-94a1-25cc2554af08", "comment": "Malware payload (Blackmoon)", "value": "4aed3dae80b3ab1d827813bd087f5a80", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160710, "uuid": "d45ca3eb-adae-4a69-b7a6-e3ec8eb6bb42", "comment": "Malware payload (Blackmoon)", "value": "cf7a4980d57b03adc6cc1cff874601449e61bd74ac27091cc575c846a47b0d41", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160710, "uuid": "b39a0dd9-1dae-4de6-81a1-2d76edbae195", "comment": "Malware payload (Blackmoon)", "value": "4bd92624911012c6f53676ef949914d72539ddd7", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160710, "uuid": "79f2cd04-3c37-4411-899e-417d158f3b58", "comment": "Malware payload (Blackmoon)", "value": "95d92cb6cbbd66299a3b65f132903c19fd7d6752a51bbe613c81f2bf13ce89beb9618c0a5d2c638b6739420c530c8f05", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160710, "uuid": "7b9b032d-d94c-4099-a9a2-a6b1ee6a0945", "value": "T1AAA4A6B21F3DE5B7E6B0F47056A91164288EB67799C919F050E223880B79CC1D9C2DBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160710, "uuid": "639d5cbe-ec29-4f15-9ef0-905e3966adb7", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160710, "uuid": "83657459-0509-4337-b37d-3a21a0581131", "value": "6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbem3:q7Tc2NYHUrAwfMp3CDm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160710, "uuid": "dd2c5a48-5134-4c79-94e7-6a68a25d3546", "value": 470251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160710, "uuid": "c9bca39d-048f-4c1b-9f29-0beb87fd6bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160710, "uuid": "b7cee856-3a68-4af1-82aa-0c7b408a8d86", "value": "virussign.com_4aed3dae80b3ab1d827813bd087f5a80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4790fc37-2611-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774199108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774199108, "uuid": "6b961ff0-be0a-4bc2-93df-bce38b2f796d", "comment": "Malware payload (ValleyRAT)", "value": "24ec7a3a8d340c33aa2e64c731d6b63d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774199108, "uuid": "cd578c42-a63c-4806-9192-8b561ece9927", "comment": "Malware payload (ValleyRAT)", "value": "d39c9c034e5ac5023060995c0393b090ecb69f288d41aecad6227f8bb5df2931", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774199108, "uuid": "58d6287b-2bd7-4da8-a3e5-6a8bdfc1e490", "comment": "Malware payload (ValleyRAT)", "value": "7d901ed5f25fd3322ef23779d2eac0bcc094cc15", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774199108, "uuid": "d8a2da94-0ea1-4891-9cc3-8f7cd1dacabe", "comment": "Malware payload (ValleyRAT)", "value": "e2804b07a673cef2f2cfcba23d4ec2c75ad84676d8462c1b9c64d51b750ed7ca2834df87b2056b91435c8222ed87d7b1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774199108, "uuid": "9286434e-6f75-40a0-99c1-29b3fe51255b", "value": "T1B3083321B67328A4DB2F67BFA5A85FD440307DE1B31BD6AB33783FA545B068551B2803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774199108, "uuid": "cabe480c-f2a2-4a1c-98b2-3fb5669c847a", "value": "1572864:7QsTGHdUpR+zlkRkrmyvRD/qoglViUngaiIwuMhNbJ/:7QsTGG3KlR/D/qok5nSucN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774199108, "uuid": "83f3cfc1-f928-44ae-a54f-3d856d052067", "value": 77529088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774199108, "uuid": "14f97b7f-494e-4eaa-935a-b23e127ab8a9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774199108, "uuid": "ed5d183e-4814-474e-a9ed-7028db5ffa28", "value": "sun_oray_v16.2.0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f7b78c-25f1-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774185339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185339, "uuid": "61cfb3a3-0be5-4bb2-bcbe-52a61f5f93ed", "comment": "Malware payload (FlyAgent)", "value": "bba94695255b7af9058440cb4f96223a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185339, "uuid": "6904670a-e38e-4ceb-8eaa-e4eb27c32c57", "comment": "Malware payload (FlyAgent)", "value": "d50b1a5cbd00a14ff20504903be3be865cafd7193bd23a235dc358e97379c606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185339, "uuid": "fe65117b-8735-4503-b0c6-41a091e2d246", "comment": "Malware payload (FlyAgent)", "value": "49d4dd54dcb8665546b285032766557a8a004a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185339, "uuid": "08c297c1-4450-4dae-a10d-88d0396d07cd", "comment": "Malware payload (FlyAgent)", "value": "bcf03d5e8230001f3f22ab3c218a0a9e037de99f1454d95007a7b74f8236bdb04d8a1933a5a73340dbb99dbc2825f15c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185339, "uuid": "db992e55-2e63-4c01-bcf8-46954d815a53", "value": "T105557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185339, "uuid": "091c2466-9e5a-4501-b9bd-b5bc2521c670", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185339, "uuid": "59b975bb-42cf-4f61-930f-450e21a91891", "value": "24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5E:WZaClSFlG4ZM7QlVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185339, "uuid": "f0ba09dd-6f74-4c89-88da-ea9dc5afe524", "value": 1378536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185339, "uuid": "182a6739-9649-4c6b-a7b1-11f826f48f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185339, "uuid": "2dbb2d73-97a2-47c7-a7ad-314b2f04fa57", "value": "d50b1a5cbd00a14f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084c27e6-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774160776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160776, "uuid": "a5c2989e-f130-4db5-b2d2-1d794a5cbafc", "comment": "Malware payload", "value": "7bb300dd3a12d7d82e8d5371de9b2e90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160776, "uuid": "3d3d3311-97fa-482c-a007-986c1739f8fc", "comment": "Malware payload", "value": "d78e48fd5308b2a48db8d412a8fe5bdea929825f60eba134bb99fc5d4e09d360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160776, "uuid": "f4bca56d-c8bc-4bc1-b800-36323b0d4388", "comment": "Malware payload", "value": "3bd92ce80a045bf941e0e2704efe7a31b2ce358b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160776, "uuid": "ac563760-e3c0-427b-ab81-9d3b74dbcefe", "comment": "Malware payload", "value": "81c0590c533f89d7eb828a26c17449ea760269bedbeb3116339a7bbca86bdc4b3877a931e22bbe286b9b08bb322f1394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160776, "uuid": "4566919f-0dee-4e04-b5ad-f449b9c0e7ac", "value": "T1FF2612B699D93E79F83052B9B6370BE240ADB8108543CD4812952DC93BEEAC1F54F79C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160776, "uuid": "80c75aed-0dfe-4d85-bfe9-263e74f002cb", "value": "fc1895e4e0bbcd532100468a814a75ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160776, "uuid": "4a7f9f77-2152-4911-8937-e239e70cd470", "value": "98304:FhoRZ1huAQtYZBNLNfDJ97eZeMkWBowPRvf+ljh/dQJHvRum+:oHu1AtJJeDrIf/dKJv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160776, "uuid": "43beb96e-c4c0-47fb-a55d-63145207feec", "value": 4733440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160776, "uuid": "db9f0a18-85a7-475a-8b55-ed2ea68174e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160776, "uuid": "3c0876a2-2ff1-4fac-ab54-c43628fcdd80", "value": "virussign.com_7bb300dd3a12d7d82e8d5371de9b2e90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f986351-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774160815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160815, "uuid": "cc22e8a7-d1dd-4174-86cc-5367c4132871", "comment": "Malware payload (Snojan)", "value": "9b83b1fd2a21eda161f25db0efc04d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160815, "uuid": "5ec25368-4897-4780-9217-63cd6661052f", "comment": "Malware payload (Snojan)", "value": "d825ec7bebea4f8a8c71b134c1695a9e7699ad9e716cd5afad7fdffa205049fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160815, "uuid": "d5f5bfba-07ea-42cd-adff-4f7e1817614e", "comment": "Malware payload (Snojan)", "value": "4dc10a87256bfb6d71cdd5f1473e3dc6d42f4b9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160815, "uuid": "e56692fa-fa99-4411-81d3-981be2fffb49", "comment": "Malware payload (Snojan)", "value": "509490d6adf00d8ec1c6f485521a6d7644c1bc462791ae0a7efde4666725dd1c06cb0d1b986c5a85c784114c469e9aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160815, "uuid": "bed467f4-6fa1-4cd5-aade-d882a4d5d9ee", "value": "T14B345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160815, "uuid": "d170a230-748b-449c-a791-2dfe7b0ae4f7", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160815, "uuid": "28c58989-20da-4815-b32b-d2af5ff008b2", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/V/FnncroP9:wwDeM7iNEkgiOb31k1EChJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160815, "uuid": "eddf3af6-8bb3-4a55-b3db-974052f67f5d", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160815, "uuid": "53fd521b-c6a4-487b-8666-20937596733d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160815, "uuid": "9b1ad3be-b874-41ee-85c6-1645e3ae6e8c", "value": "virussign.com_9b83b1fd2a21eda161f25db0efc04d10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b426ac9-2626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208160, "uuid": "7589588a-6d1d-4778-bc9b-a7be06e9d107", "comment": "Malware payload (Mirai)", "value": "ef522cd81a12eb03c74b81853138da05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208160, "uuid": "81788b00-664c-442f-a46f-9048e41e9139", "comment": "Malware payload (Mirai)", "value": "d957c5d271a5a7eb46b4f39fcd9db88241f02f5c72b0350051672c1a6111d90c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208160, "uuid": "4cea65cb-7b1a-4f48-93d5-356cf6899a95", "comment": "Malware payload (Mirai)", "value": "1860721033d22d2d3d97e7dc940db401fadd5778", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208160, "uuid": "ad2d7299-1396-4f8a-b917-d6062a71ac7b", "comment": "Malware payload (Mirai)", "value": "5ef34a60c4bcb495c18a4500d82d33bebab764283a77d32387e9cedfa3d7fc66429533698966bbb9effb2ed83793bce9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208160, "uuid": "5a6fefa4-e2c0-4b7c-a69d-8bb5bb0b6edd", "value": "T1C14302D293A62900CF298535043E30468812F94BF697F69EDBDCEEDF16203627A7C257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208160, "uuid": "23b996f3-3896-4ee7-998b-2a1dc613be2a", "value": "1536:B189hPYYTi3K5QJjCpp9FPECAkYDcnouy86J:nW35QoppzECAkYD8out6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208160, "uuid": "cbca7509-434c-4077-9af6-8883a5abbfb8", "value": 60432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208160, "uuid": "4b97d578-d604-4d36-8ace-84c1c2c303b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208160, "uuid": "ef33c3c7-59e8-4a18-b23b-3a8a329feab3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84713afd-2617-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774201787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774201787, "uuid": "145151cd-369b-443a-bb2c-a9c9bb577431", "comment": "Malware payload (NirCmd)", "value": "99cbbac115b9f6bb49d9fca19a4b13a9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774201787, "uuid": "365062f3-af4f-41ca-ae4e-8ea27a3e29e8", "comment": "Malware payload (NirCmd)", "value": "db9b43a0679f88c51197af4a266a1fa8d0a853a654b33139979953c9f11ad6c1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774201787, "uuid": "4e2ea791-2754-466d-bc57-a6acf39d632c", "comment": "Malware payload (NirCmd)", "value": "67fbb64d904e4b4c4f9d541713a1a310e3e1a9ab", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774201787, "uuid": "c8ae1fa4-d416-4a89-aade-cc2c958bffdd", "comment": "Malware payload (NirCmd)", "value": "927e23a62c559aac7f076072afeb26377f5bc150da3f53c14a96c3fe6d5bd537508418a27b80c59e9682659cf723dd7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774201787, "uuid": "58e582c0-973b-48f5-9e12-3d23939557af", "value": "T1A3A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774201787, "uuid": "c7e8991a-e0c9-4a14-9995-2682aa204e9e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774201787, "uuid": "75afd311-4129-462f-bc6c-bcc0e8741eca", "value": "49152:ABRsTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:amTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774201787, "uuid": "1c353149-78b3-444b-ab71-b6039cadd678", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774201787, "uuid": "8b3522d4-4fa7-46f5-8e1d-056a2b7bc40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774201787, "uuid": "e9900bfc-792a-4fcc-9864-3b10bf902806", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8deb4f-25f0-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774185102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185102, "uuid": "c7097498-4cd7-4ae8-82e7-582acf9419e4", "comment": "Malware payload (FlyAgent)", "value": "14693fd0fe38700bc3719ee374a39d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185102, "uuid": "9303d354-caf8-43db-80fd-27e0ef9c7b2e", "comment": "Malware payload (FlyAgent)", "value": "dd379852336bbf2b1b53c2b0c6f10f3f085b93fb2f75859f59179cfbd4544801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185102, "uuid": "38920702-929a-46d4-b6c0-21e96b1f7e86", "comment": "Malware payload (FlyAgent)", "value": "9fe0327efe579f50d29f5baf2d09d86f8779ea71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185102, "uuid": "ebcc99fb-d50d-4312-af16-016f13de1ed5", "comment": "Malware payload (FlyAgent)", "value": "4e9e3c7da0c6d05f5d18fdd389bd6577c2d27b1c8998156a7b929950c3d4ca2b00768b025846ebd5b671d061d62b73e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185102, "uuid": "ff1625b9-d3b2-47ea-a3ac-fdafb9118456", "value": "T123458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185102, "uuid": "46961786-f63c-48b6-b916-e7ea0fa3a08a", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185102, "uuid": "546198ce-307a-4759-b978-7d8a25f684c8", "value": "24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qk:acallSllG4ZM7QzMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185102, "uuid": "489b69d9-9e03-4d32-a459-81a8242d5a93", "value": 1174399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185102, "uuid": "a4ce9142-e409-4a4a-96f0-47e8d0585374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185102, "uuid": "a86cfe10-3337-4733-93ec-91f716a0073c", "value": "dd379852336bbf2b1b53c2b0c6f10f3f085b93fb2f75859f59179cfbd4544801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba9adb0-2634-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774214362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214362, "uuid": "e597d6d6-2010-489e-bdd2-89c28dcb1f89", "comment": "Malware payload", "value": "68dbee8fa088ad7d2521cef375a2e807", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214362, "uuid": "d5a97a8c-fe2c-46f7-9f53-58d29a867fef", "comment": "Malware payload", "value": "ddb285be2141aefb6414b44dd517e568735ccb57bc694d1b447fd18751e1cec0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214362, "uuid": "8f29a1d0-9223-4225-894f-0deba799dcb4", "comment": "Malware payload", "value": "991b3ba714018e5ac1788dd6faeb8fd1ef486905", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774214362, "uuid": "76ef2a85-94cf-46cc-8073-ecef04b3235b", "comment": "Malware payload", "value": "b02c931dc9b04541b061ae0770a7afb07bce565209c3f7bb76c3990a94a26dfc4b3fc83ccf2d995d057d0d6c285adea2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214362, "uuid": "208c0a85-676b-418d-adbf-c77882000a86", "value": "T15C925DB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA0F39215A1166DC70534A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214362, "uuid": "3ebbee99-6924-42e8-b6b5-c9576e1b350d", "value": "384:WFcuQpWx+BL0SWL0gQzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:WF8i+BL0SI0HzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774214362, "uuid": "849d7812-a7de-4255-bd27-ba313c617fe0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774214362, "uuid": "a3e5400f-ae80-4adb-992d-7d9c69fec0cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774214362, "uuid": "6ac0c625-13d5-4462-847c-b9d6883d41d8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dbc9de-25df-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1774177825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177825, "uuid": "a1305faf-0173-4167-8330-99d2e1b33be5", "comment": "Malware payload (RatonRAT)", "value": "59fc88763b9e27e3dff6992b0f9fa8d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177825, "uuid": "ecb0264d-f36a-4d26-93af-8c8bd5c05833", "comment": "Malware payload (RatonRAT)", "value": "ddf39cc82dff3cd3cb7060d175e1bfe6b282be5165d0d7c2e3948389ff07ec26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177825, "uuid": "64332322-ea6f-4c09-8581-c642ee2172b9", "comment": "Malware payload (RatonRAT)", "value": "e0f91ac444fd33c6b831a171f0be27b55e9f9497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177825, "uuid": "d7709ba4-5750-4631-a24f-29081234244b", "comment": "Malware payload (RatonRAT)", "value": "6a88aa791a823362f43aa7960b1e701d1f6f55aaa3bfed5825ce8bba970cf10bfb8ceaf6eced29ae53bd7a25d18fedef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177825, "uuid": "3891aec4-1de9-428b-9455-50a9a2b734fe", "value": "T1E4936A0033FC6926FABF8B7C5CB464554B3279276D32E64E9C8A609C1A71385DA20F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177825, "uuid": "3e64e872-788c-44af-8cdd-9bb5c32c3932", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177825, "uuid": "7f1cd6da-a6d2-4433-9796-92c8842f0c08", "value": "1536:fTiJJeZCMLbQUxKxNulTsqa4tsi5+/GuGFjlbbKpKCZbszxD:f2JYLLf4qAX4tnQKFjlbbKXZb2xD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774177825, "uuid": "b89435b3-0070-45ae-a709-4b26d19425ac", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774177825, "uuid": "ed9fcfe8-75cd-4eb6-a398-b2a957c3979d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177825, "uuid": "d4da01b0-f305-4fd0-8a0b-c91c1db71058", "value": "dreamyware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fda576d-25b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774158803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774158803, "uuid": "dc577a3f-bf85-4691-bbea-f6d515e1a2d5", "comment": "Malware payload", "value": "9e4852abad4aeea2fd71f928a032bf8b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774158803, "uuid": "4c62fcc9-6279-4954-8994-9f1640d96ae6", "comment": "Malware payload", "value": "e0171574e8d547f7ae80a7769ab84012feb1d97098dc9c5cfb04493a448fc28c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774158803, "uuid": "38d2f8c3-a529-480d-9122-2033672654cd", "comment": "Malware payload", "value": "03c85f1705c7252cc24f53cf981fae226f7e295e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774158803, "uuid": "691a5875-0936-4b89-ac62-f270752e9026", "comment": "Malware payload", "value": "4e662f8147f230927059a4ed6f2359cc5d91c72f02881021b0bc6f3a950a345cccb17b5f7d9c506ff956668fd66054a2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774158803, "uuid": "220b5e29-909e-4e73-a2e0-bf664ec5a16c", "value": "T1A217DE23F51529A6DEC5A134F4E7679537301A440793A238671FE02AFDB21DECA37AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774158803, "uuid": "9da79b6d-5810-404a-86ba-5e09b2fa6cbb", "value": "393216:kOPUBb1VP0d4KVPJyKmEL4pqF2CbnUnYY6knzVJY/VS:/sRneVP8ze2CbUnEknJa/VS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774158803, "uuid": "2cbafc46-c98c-4256-bf44-800ef61e8119", "value": 18938087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774158803, "uuid": "8a3a8481-e08a-406d-8138-eabddc2ca401", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774158803, "uuid": "2aeecbc0-a07a-477f-9c15-94daee5196e8", "value": "MParivahan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f97ac8-2582-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774137986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137986, "uuid": "9aa92987-2964-438a-94f5-2a4272a09a6b", "comment": "Malware payload (Vidar)", "value": "1a91b87981371f7a5a69d7d68f8ec3a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137986, "uuid": "e6fbb24d-6bf5-4c55-a71e-ea6d50f8a99b", "comment": "Malware payload (Vidar)", "value": "e01dcb6a1cf127f207d3dba96ebe5152956bda392104fad8932f24ac45d9f627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137986, "uuid": "d94cf30e-d749-43a1-b545-1b3f5c576809", "comment": "Malware payload (Vidar)", "value": "5f4524025a8c16ee97c53e28dccabdbf1fa397f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774137986, "uuid": "b30837fa-03d1-4c26-ab01-1baf4dbd04ae", "comment": "Malware payload (Vidar)", "value": "7e761214658070a801f1a5c2ebc0e7edd00b4dfb77a800524d0436a245dde8ac4386d3831230990445c6c1fe7613045a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137986, "uuid": "f2000a4a-ed14-4afe-8117-f720996d419e", "value": "T1C0D42BFE9D60E325F60DD0BAE247D7528F2138011236A6A329BEA3141245873DB677FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137986, "uuid": "46567667-5209-48da-afc4-cb3ce2d7f55f", "value": "12288:r7auuPSlU5B0umJF9Iv/ht+JSe9gke2nHDxH1Wg17RWc:nTuPSlUzuj9Iv/q1PGgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774137986, "uuid": "108883f5-9cd8-4e3a-b636-d1b217b25087", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774137986, "uuid": "64887f58-140a-4d3f-beb7-c8d5f3c55532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774137986, "uuid": "1787d24f-fae8-4c90-a397-71939c86abfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a6c6bf-25e5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774180316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180316, "uuid": "49fdd741-1bc3-434c-94fc-515cccf5ceff", "comment": "Malware payload (AsyncRAT)", "value": "48cf17f88aeb84b9dd964a85346dd6b1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180316, "uuid": "162e0c9a-1cd1-4717-ae6c-eabc773fe0f0", "comment": "Malware payload (AsyncRAT)", "value": "e14941788ae13f47e674ed11755a8f57370bbbef6c4a43369e1791e53e44d24b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180316, "uuid": "f516cac3-e491-4312-8030-7a1229ddfedd", "comment": "Malware payload (AsyncRAT)", "value": "c1bba970c1c7d13a8b023843d763c0532fed1ac9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774180316, "uuid": "734da7f6-624a-4285-82d1-f88e90ed63de", "comment": "Malware payload (AsyncRAT)", "value": "8b0ef37bd725515faee8dd9e32c28ade1fb4469f94c23a1ceba448f66013d96c572db19c7d1d9cd8e69b4d8f5f681708", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180316, "uuid": "75f0771c-d81c-46e4-8271-37147d6db00a", "value": "T1F0E24A1977F24616D1FE5FB828B222034271E51B9D23EB9F0CC5949A3F67BC486807E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180316, "uuid": "d8fc61ab-1d98-493c-95b1-7c74ee39ffcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180316, "uuid": "b80cedd8-114a-4df9-9ced-4473703b2e12", "value": "768:gUacX7e5mJB/Prx3kikPBeZbbsOjhut3Y:g3/cjx4ZYbbsOjA3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774180316, "uuid": "f3d9b29c-b4e7-41a0-af7b-a382b80527ac", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774180316, "uuid": "9401e828-3c34-48ed-b90c-1e9d4c43a219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774180316, "uuid": "139cac61-373a-467f-af8d-ec7e5443005c", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f905dec-2602-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774192813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774192813, "uuid": "0f7ac38d-a64b-4d98-a0db-e9d0f4f1cb35", "comment": "Malware payload (AsyncRAT)", "value": "1091bbbc88aad1130d4af2599b24bf36", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774192813, "uuid": "2ffa9556-67d0-47ac-a44a-06246c1892af", "comment": "Malware payload (AsyncRAT)", "value": "e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774192813, "uuid": "0d98cb90-0c38-4722-932f-17e075d54c9b", "comment": "Malware payload (AsyncRAT)", "value": "ced6f26a5054977d1bd463db15e1f968569936e1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774192813, "uuid": "bc87e9ee-f561-4f8b-a71a-7ffdbe010faf", "comment": "Malware payload (AsyncRAT)", "value": "748efc8f9065b8fb20f11d0890b7d5115e3c1c684fe1423ff93696d10915b5f89f05a5b29b34027462067223f692a26e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774192813, "uuid": "07397508-7d00-4132-abc7-67dadd4059b4", "value": "T118B5BE92D3E844F1F0771F345C7987652EF6BC254EB4965F0286B60E2D33A854AB2B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774192813, "uuid": "d57fcadf-abab-46de-9bcf-a8cd60825428", "value": "74a352b7be38be736b4f1e0d51b66e8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774192813, "uuid": "27e5a649-4063-4230-ac5d-2e362471b93b", "value": "24576:IeaJNE7c3OyYTsJmyFIOi+1O7xG8zL1SlNHXxQNF9PAPtEGH5A9oV6FaTv8:/YO1TsJmvOiz7ZLit2NF9YPbH5ca78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774192813, "uuid": "13b3e268-bd9b-4e64-a63f-fd7f00579800", "value": 2397064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774192813, "uuid": "5f852486-f804-4ce9-9c30-c5bea43ac53d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774192813, "uuid": "931ce374-a068-4157-8aa9-217b0bd7af10", "value": "e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9145f89c-25e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Quakbot)", "timestamp": 1774179904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179904, "uuid": "f3977da0-e579-4ec5-be4e-abada8f8a53e", "comment": "Malware payload (Quakbot)", "value": "c35c05ad3bb3bf9b6b317904fc482e40", "object_relation": "md5", "Tag": [ { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179904, "uuid": "8d28f929-00a7-40a0-8295-248912a39148", "comment": "Malware payload (Quakbot)", "value": "e356e8a237be37d4dd45d93b1cbed0d0d8a28b31a0be32e0aae08512fcd32105", "object_relation": "sha256", "Tag": [ { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179904, "uuid": "122f548f-48a8-4455-8f8b-cd7edbf054e1", "comment": "Malware payload (Quakbot)", "value": "20ea6f13986d5e94c63f09ca4bd979b303c82c2a", "object_relation": "sha1", "Tag": [ { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774179904, "uuid": "5554eed5-5261-4f27-b500-4afc3ed0be95", "comment": "Malware payload (Quakbot)", "value": "292df770184564686df5f25601bc8fc0cbad509e041c81fd25586a802a6c066b505c8c2c5b8081c1d984cd1163697300", "object_relation": "sha3-384", "Tag": [ { "name": "boxter", "colour": "#5D05A6", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179904, "uuid": "c41cf39d-26f2-4b84-974e-3fbe7fb915cb", "value": "T16C318E1117F20328EAFB8B399CB663214675B90ADF518F9F029081985574520E874F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179904, "uuid": "5b31a4d3-c8e8-4b20-8cee-f5933efe88c5", "value": "24:838dmGjMDvSwjKUaWU3AcPWkp+/CWzlsCeUMkWx34z0KRnAH4I0WK6c/6Cab7Oaq:8mmeKpUQLl1eHJ3KTnIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774179904, "uuid": "6b6cbb03-6e56-45db-ad68-61505421924b", "value": 1545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774179904, "uuid": "588279f4-9d05-429d-a3cc-d38093f924f8", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774179904, "uuid": "3718a9b6-a2f4-428e-96e8-5ba63f4ceb00", "value": "e356e8a237be37d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91824308-25f1-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774185488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185488, "uuid": "756108d5-32a6-49c9-a8a4-8ae9d75e6993", "comment": "Malware payload (FlyAgent)", "value": "c233c3b45f8aa912742c3871ff0fad73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185488, "uuid": "361b7708-e039-484d-ad18-e2405ba90384", "comment": "Malware payload (FlyAgent)", "value": "e47090f029066858af74e9a47303c21304004c5707e8f130ed664804c90dcd13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185488, "uuid": "c730e05c-e1e1-43f0-b087-d5ed5296add8", "comment": "Malware payload (FlyAgent)", "value": "2c3d0a2dac87204ef546042b3dacc6859168b689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185488, "uuid": "14b55fdf-2f69-4f17-8d08-ce13dedb2bcf", "comment": "Malware payload (FlyAgent)", "value": "965b08fb275a8563646e29acdbec1809c54d65af7b59f89e340d198d2f5a8cc3ef7ae3f668aadb57d5bece5b27a86a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185488, "uuid": "57a483b9-7d06-4449-a45e-5b12a20d94e9", "value": "T115557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185488, "uuid": "f4d03f3e-3cef-4f5b-8594-43eff0f655ef", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185488, "uuid": "e0627ab4-d33d-4e69-ab52-250532fad8c0", "value": "24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5V:WZaClSFlG4ZM7QlV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185488, "uuid": "a594c7b4-7717-4014-bdeb-ab5934a277bd", "value": 1378540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185488, "uuid": "7c319cf0-ccfd-411d-afb9-05abaa8932e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185488, "uuid": "c1d82d88-a4ea-40b2-934e-210f25667ebe", "value": "e47090f029066858af74e9a47303c21304004c5707e8f130ed664804c90dcd13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40d6742-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774161065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161065, "uuid": "6d3ddf1c-e479-43d9-bd06-386a192779b6", "comment": "Malware payload (Berbew)", "value": "e1557950973b077756c7be25d3806270", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161065, "uuid": "283bb66a-537a-4a4d-a3a2-e9f9a86b4b7a", "comment": "Malware payload (Berbew)", "value": "e63f6f96da59c6a894fd3614faaadd47b5ce0d8e1828c5fbd2dbc0b4a33fe01d", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161065, "uuid": "39336ed7-a274-4a5a-8744-fef6a18c7962", "comment": "Malware payload (Berbew)", "value": "04bfdf23346d77162d6e43585e7b9fe6c4fa9a1a", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161065, "uuid": "3c485a0e-f70f-4fa3-9f4e-7021f7738c08", "comment": "Malware payload (Berbew)", "value": "33941db3ef413a498a2bd3e3767a301b6a7485a256b1dc8d47c17099b3c37a8857b6c8a432fc577a1fa416c36f97d291", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161065, "uuid": "bc9d606d-b8df-4b8c-b27f-0cbb19e72439", "value": "T142D37B5FB2842F73C64232B5260DAEDEEB2E51797E69C490142C831F166BB19837F5B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161065, "uuid": "596ca838-2fda-4d45-ad3f-a9274852f906", "value": "8c06df3257a07b290c16c6c995c9688f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161065, "uuid": "5f6f5991-86e9-4ceb-ab18-6e06413cb49d", "value": "3072:lDDLlkAHTzaPlpghobaopoDJ9ZLCqwzBu1DjHLMVDqqkSpx+2G:1DKAUbaoqDJ9hwtu1DjrFqhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161065, "uuid": "a2d454f0-56fd-4c03-88c8-03a3214e5cfd", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161065, "uuid": "453b314d-2def-44ef-a09a-592d7d441fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161065, "uuid": "1f4f0e51-d649-4605-aa94-65b4abaacb98", "value": "virussign.com_e1557950973b077756c7be25d3806270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac3c240-2628-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774208992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208992, "uuid": "2ae1cf6e-4dc5-4062-a14a-abdcc44a241f", "comment": "Malware payload (Mirai)", "value": "c00371fa196ec8aaaaf34f9e63046c36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208992, "uuid": "8ea8c451-a05f-41b9-84ee-ddfdd22f8370", "comment": "Malware payload (Mirai)", "value": "e98188fb59ac4ace244eaedacb7eb765b3cdca29bae74ce59ed7a2137c2afacf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208992, "uuid": "19a996f5-37e3-4d4e-8fbe-46b33a00d185", "comment": "Malware payload (Mirai)", "value": "01c883e0392322108e143fb685b12d2fde823b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774208992, "uuid": "a525d720-1aa4-48f0-94bf-eafa539cbb78", "comment": "Malware payload (Mirai)", "value": "2759856f568061c25dc65d82d5ff95f2af24a4eb928f7446fb9603e66bd852804d7f50e05fab665557395bc82efe1b93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208992, "uuid": "6aaf1e5f-dba8-47e7-b3f8-3c7c8071946c", "value": "T172A33B85BC429A22C6C1567BFF5F018D371613ECD2EA32139D295F21778B81B0E7B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208992, "uuid": "0ab6fb93-9ae5-4dd4-b360-f39941ddecc0", "value": "1536:R8ErZASH7UvdtUO/OESv5xuiq3vMvnhKPQ2nYDh9MKBWHVEaZU6Ii3ZOtSLtG+fG:R8E9AKiLOTjNfMQF1u9VEYU6xFff+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774208992, "uuid": "8a507190-44d9-41ec-bb8b-b6569a75eb20", "value": 103668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774208992, "uuid": "3923914c-4b05-46fd-8449-9e6803415837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774208992, "uuid": "6028c86b-3f0a-42d8-a2d7-a8607bb36ffa", "value": "tux.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784cfd66-25b4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774159246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774159246, "uuid": "a0a8fa41-5feb-4068-a782-772323f3a64d", "comment": "Malware payload", "value": "3571abcc0cad41c727eecd1b6ab270f1", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774159246, "uuid": "06fca414-0192-4174-b715-ac4aced2d845", "comment": "Malware payload", "value": "e9914793cbaa2cdd1827ab8a398ea524e543a21f2117cb2afab633a9b7419d21", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774159246, "uuid": "f85d1352-c846-4d91-8347-22cb243d5be2", "comment": "Malware payload", "value": "07bbd13320e845abe4dd2acf4f4f41797d48b706", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774159246, "uuid": "66435035-5744-4556-a499-5c367273c768", "comment": "Malware payload", "value": "4486228b6164dfb3a197cbc3c322c3790847d1c8e912f8ce4098f59738489af6a824d4fa0c26ed21075a5984229075cd", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774159246, "uuid": "693ec5ae-c475-4a49-94dc-f22c94043393", "value": "T18AB3F1895A8B84A69B1F7035821F5E4B9F9C911B023CC5C0BADEEF483F119F571BA6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774159246, "uuid": "87251f75-6dbc-4e93-8e68-3b5d7d1fbbc4", "value": "3072:avtwzBZwjyzV5YbwJOPstkY1Meei1kEsz:aFwzBZwjyzV5YbwJOPstkYWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774159246, "uuid": "3f2154fa-0b66-4c0b-9259-fda4f9a92f6c", "value": 115749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774159246, "uuid": "0851c7f7-dfc2-4383-91c9-dd337ab693e4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774159246, "uuid": "cabe83cb-e88d-41a0-8853-f5c36ff74b79", "value": "Backup_Canada__57.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b546a98-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Fanny)", "timestamp": 1774160513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160513, "uuid": "65befdfb-f376-4821-9a8d-515c6250cb6b", "comment": "Malware payload (Fanny)", "value": "0a78f4f0c5fc09c08dc1b54d7412bc58", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fanny", "colour": "#D414C1", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160513, "uuid": "1f920120-ade1-4d65-8a7b-d7e7bbc4300b", "comment": "Malware payload (Fanny)", "value": "ead01383f9da349217fe53b2c3ac770c944861797678a8c374651e407ccdab66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fanny", "colour": "#D414C1", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160513, "uuid": "0618f8e3-54c1-4f6e-a07d-12c3cee545e8", "comment": "Malware payload (Fanny)", "value": "621299e66320a532dd2f734fe1890be03528896c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fanny", "colour": "#D414C1", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160513, "uuid": "49492953-77a6-41d4-81c0-c7544600d606", "comment": "Malware payload (Fanny)", "value": "81ecc01f938ce67f21e81442b3fc9de2b6bb7bcdd8a4aecae6b531d799daa02c9a6eec536d229a92d6429ac917ce28c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Fanny", "colour": "#D414C1", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160513, "uuid": "52481bec-ea73-4b94-8aee-7fd34aec75da", "value": "T15A048E0A9B9702A3DAA4043071945ABB7FBE7C3338DF646FCB165A3115A15C5D034EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160513, "uuid": "9c5d49a6-6db2-430c-91a3-8b7e49036701", "value": "1f5e76572fad36553733428ca3571f53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160513, "uuid": "9fb7c3bd-d3f2-4153-b326-952ff0ba6081", "value": "3072:TtnUNALmVZvvGBeQYejpFIAq2tn2TBfki43y97FozS4Oq1sqH73oGC:p4LvkwejpLqun2TB8i4i0zLOosqHkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160513, "uuid": "38cb25e1-2b08-4b92-a444-599eb9838eb9", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160513, "uuid": "1d921625-9333-427b-bacc-0fc321dde605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160513, "uuid": "ce4a32ef-b0ac-4c6d-8763-aa5a5ebda58e", "value": "FannyWorm_0A78F4F0C5FC09C08DC1B54D7412BC58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c0de67-2588-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774140317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774140317, "uuid": "8fd7f856-731b-48ec-98dc-41c10b53573e", "comment": "Malware payload (NetSupport)", "value": "59c67cbc48800409a2aef24ce6a81cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774140317, "uuid": "e8be93a9-7e9e-4017-a41d-219f20627e74", "comment": "Malware payload (NetSupport)", "value": "eaead70e16bc9ed4d6bbf6e3c3a8105c7a39984656e09a1d44dcbf3f98ae9e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774140317, "uuid": "b5b6d40e-c833-4c32-b128-5407a1e1df9e", "comment": "Malware payload (NetSupport)", "value": "50fd8dd54f82c71898bd8969c5d4428ad48544d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774140317, "uuid": "32d19507-7220-4377-a043-299d6cb3ef36", "comment": "Malware payload (NetSupport)", "value": "ccd570540185d81768c48d934f69b84feee347077970c699956da7cc27d840f55f862eccc6c52c4fe842ab799f6e670d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774140317, "uuid": "0185047d-4983-4c23-89be-9db44cc5ee60", "value": "T19CC54B07FCA118BAC0AEA133896395517A717C441F3263CB3A90F7682F73BE49979764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774140317, "uuid": "4771b857-bcf6-4cb0-8ce9-5f710015ea85", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774140317, "uuid": "af7c340f-6b28-4dc3-988e-7b2362aa8ff8", "value": "24576:QxMUPSLTD3V7tyFXg422Zc8N0dblFT0Wz3MxLrTjClZ3z1wLG8cWD/QvUSgbukcm:Qx56TDl7AFd22ZPN+BFT5bMFjnQc34hE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774140317, "uuid": "93a9b457-3ef0-412b-be04-ee35e0363485", "value": 2526952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774140317, "uuid": "42628449-d4ed-4661-ba38-1a3b65f2dcf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774140317, "uuid": "57645146-cb4c-4003-989c-a49d4fa3725c", "value": "SecuriteInfo.com.Win64.Malware-gen.47829823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66685e07-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Laserv)", "timestamp": 1774160505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160505, "uuid": "e13dfcbb-89d5-498c-9056-1177ddba73b4", "comment": "Malware payload (Laserv)", "value": "32c53df631217d0b5f9f46d3a9246715", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Laserv", "colour": "#682516", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160505, "uuid": "77c9bef5-539e-4f01-9749-4fb4d73239bb", "comment": "Malware payload (Laserv)", "value": "ec2a717739947d3512513889bbecd9a0dac3fb65f8e171f8a0835abe8c1537e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Laserv", "colour": "#682516", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160505, "uuid": "9ded6e5e-5f96-4a8f-a87f-534a9c4f074e", "comment": "Malware payload (Laserv)", "value": "0a8c8551585d5b2c4565e103e9a6128736334822", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Laserv", "colour": "#682516", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160505, "uuid": "9ebc5b3e-f876-45f0-ae2a-6bebbb03eb3c", "comment": "Malware payload (Laserv)", "value": "2cf4dfbb9519bdde0455b213bd3f15e80ac788d03b89ec44e22f0542ba9288ea4f2db975e1078f1f23ff6c646f2de10d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Laserv", "colour": "#682516", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160505, "uuid": "84721452-63b0-4fe7-891e-7e1036aa2633", "value": "T1F1D39D42BE418CB6E1C3107D005A673AD6FBE8732499B8939374CD6519B5213EE973CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160505, "uuid": "743ec6d1-81ab-40f2-9c7f-a1a7910cfc5f", "value": "ee845c2ebf05004bb904724010b3d898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160505, "uuid": "98b03687-acc8-441e-b99b-95dc1c34975a", "value": "3072:LWJE+I/l81jT8jO3HTVNZHz4fz6SQgR/IU5+4JrJjE9g:LqEl98RTMOXRNp0LhQgVh+cJMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160505, "uuid": "e2d8d290-6051-4254-aa0e-6a9568beeaea", "value": 132610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160505, "uuid": "d20e1f64-2fdb-4780-adc1-f902588c04a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160505, "uuid": "c01a4935-6e3b-4cec-be23-1ffea25b5a90", "value": "EquationLaser_32C53DF631217D0B5F9F46D3A9246715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036c3aa8-25b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774158621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774158621, "uuid": "04169ff8-eb94-40a7-9311-5b2b7ecbc710", "comment": "Malware payload", "value": "8d2996910b36e90444e967ecab5d3dad", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774158621, "uuid": "79a1a38b-0d41-4574-865f-3109bbe73d23", "comment": "Malware payload", "value": "eda7b5698cc90a97e44fa863f16d19526a830b57769a9f89097659df88e985fa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774158621, "uuid": "27622688-ac61-4834-9b29-5b9050dc2716", "comment": "Malware payload", "value": "f57c3ecca99ea50f03f24bb79f5cc933b364ea70", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774158621, "uuid": "95b9ff8e-d913-40a5-9de6-81a30d987709", "comment": "Malware payload", "value": "74d4db7db0be7c5c09b9c5e62cbebc4b0c46a6ecb6b981f3e5f0f614a6c9bb6b14af3b34d54f87ab29f9ca8b6eade5ea", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774158621, "uuid": "081f7ae0-a661-47e8-bccf-0d4d0641920b", "value": "T1049602D6F7D8A92FC4374073C9AE52B2514B4C168A87DF436D09320C69BB9D81F5ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774158621, "uuid": "5511c193-f70f-4334-9995-76b5f36e8f73", "value": "196608:cNqIzhpJWKISrVCV+fVuLgpiKZ+Hgi1HrMhQC51E/amNRer:o3V8+fQUiC63Mz1E/au6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774158621, "uuid": "5e836b00-9262-46b5-a65a-0fb11eca6fa5", "value": 9334034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774158621, "uuid": "0a003d6a-76ec-4a63-a211-90471e22b09f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774158621, "uuid": "cfff81dd-9c13-46e4-9b23-410d592be84b", "value": "mParivahan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27ef9f4-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Nivdort)", "timestamp": 1774160606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160606, "uuid": "70e875a3-dbfe-4e3b-82f7-89c0ffe3119f", "comment": "Malware payload (Nivdort)", "value": "ed2cd14a28ff2d00a5cefcf6a074af8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160606, "uuid": "02ce3955-b46c-45f2-a231-a4db9bfcf7ff", "comment": "Malware payload (Nivdort)", "value": "eea059174127860154f4dce1a7d8995a9a5056febf73819d63ddadb522ed6c8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160606, "uuid": "79bb1dbd-278a-460e-8d7e-1960f54dcb5b", "comment": "Malware payload (Nivdort)", "value": "5b3e04f8208d3de912413efce27372255d6b3fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160606, "uuid": "de1c82a2-2e1d-446a-b88b-e338ce916ba7", "comment": "Malware payload (Nivdort)", "value": "c78f4038f7cb440d143300d846dc7c527d0588f969bacf95bc2a7780adc1c29e88b547bed4582a748b4a1d7085830728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nivdort", "colour": "#21A77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160606, "uuid": "6b7ae11f-a2d0-4619-8370-a3a68002e93d", "value": "T1FC157E249261B426F68A8073532AD7B7291253322F506DD7E3849E9C757CEF25A3F20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160606, "uuid": "89d97fbe-4826-4295-a146-283518ea2f99", "value": "3146614d7f0e63bb03fa4283c5ec4b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160606, "uuid": "bd0f22e7-cd44-42ac-8b4a-2c7185cb2bfa", "value": "24576:3BgjXGPO1tWpi+2NfonQgvb6VBg3JJgn/+:Wj2stWpMoQqbWG5Gn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160606, "uuid": "3f56b1e9-ad3a-4594-ad46-7cd7d7ace0ae", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160606, "uuid": "f28f126f-3df9-4ec0-abec-a8731ce0c3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160606, "uuid": "ff83db89-2718-4cb6-b5de-eb9060cfab07", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b438ed-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774160452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160452, "uuid": "6d91b695-d818-42f0-9ea4-e8f19a5d1a55", "comment": "Malware payload (Mirai)", "value": "a57c9666003b5bac3670a9bb68a4e216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160452, "uuid": "59c40edd-93b0-42e6-89f1-9a33867fdbe4", "comment": "Malware payload (Mirai)", "value": "eeee62f2188ba29839703e6bcb0912ff90fc442a0f8974ad1cfc37d167d8bed5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160452, "uuid": "730119a9-cca4-4e22-8977-c019477fa5fa", "comment": "Malware payload (Mirai)", "value": "2db4f96090fc118bf1448442bdec8e192c9336c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160452, "uuid": "3930e366-b915-42d0-a1ae-0b8eb4bea131", "comment": "Malware payload (Mirai)", "value": "a489ddcd08f617e751c961bf678a23225ee06543bbd3c36012e876e21482b43ad2780e5ab64464f223b1e9ab5bed823c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160452, "uuid": "ef997cb6-d13e-424d-8609-3be600f1dd1f", "value": "T1156402D3D721BD9BD81386B0656F13987378C38AC34B928173489D6D397E34617AA2CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160452, "uuid": "77ec9898-3ea8-41c6-80d8-ee117e397ec5", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtoTQ33Q:2IIKXhZtL7jOTyIG87XSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160452, "uuid": "4892ccab-0ec7-492b-926a-c6ffedbdeb1a", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160452, "uuid": "01072462-c434-4f00-ad47-d979ed3aef16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160452, "uuid": "60b86988-fe7f-43ba-80b7-4218673b91fb", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cda1b3-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774160992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160992, "uuid": "489cfec7-0453-4ba7-bbc3-ac5db9d06ee2", "comment": "Malware payload (Berbew)", "value": "c9e539c1c3eb6af4309a87bdcf35f870", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160992, "uuid": "23426217-557f-4438-a2a1-f3430691a10c", "comment": "Malware payload (Berbew)", "value": "f06b863f0be9c9f925627f92eceae12c73000ec254b5bcc7c56b913845b30a0f", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160992, "uuid": "f8244758-cb83-4a8d-a8ef-4dcd0edca29b", "comment": "Malware payload (Berbew)", "value": "731ee68d755d6f433b43d6245a152a6a66213898", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160992, "uuid": "28448d1d-f2ac-4a30-9d5e-7b2961cdbab1", "comment": "Malware payload (Berbew)", "value": "8c0b3b58625a6a94b5f27f80cdfb927d6057a8a74e7d5f5fbe067b3f0f38e996800e94a2532569d1fc358aa9583c89b4", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160992, "uuid": "c129c1b9-1e02-47c0-8ad0-f372d093c5df", "value": "T1EDB4AEC7A6D03E97C6C121B4BC057AA3216D952CDA74C2892F78F2F91636A34C7379D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160992, "uuid": "13b43e8e-db2b-4d1c-89d2-d02a38dee333", "value": "8c06df3257a07b290c16c6c995c9688f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160992, "uuid": "934070a1-7c00-44ba-8b95-5f29b5dab43c", "value": "12288:BJd/srtuFjAh//+zrWAIAqWim/+zrWAI5KFd:1ItuFjAh/mvFimm0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160992, "uuid": "2271507a-0485-4801-9705-ce27934fcd39", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160992, "uuid": "1a7a98f8-d82b-4d3a-a6b1-0c0b32d19e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160992, "uuid": "f6267c91-4d8c-4487-8295-089b44fcce80", "value": "virussign.com_c9e539c1c3eb6af4309a87bdcf35f870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19df2344-25f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Sality)", "timestamp": 1774185717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185717, "uuid": "d86ec717-5670-480d-b0d5-74efce4fa302", "comment": "Malware payload (Sality)", "value": "d2fce530662f19987e445febd00a3223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185717, "uuid": "66c2659c-df28-4896-a83b-d03c6a533e88", "comment": "Malware payload (Sality)", "value": "f073b23d47e6147dfef23e17170452edc57f09044fe64a872025c40ce6c70d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185717, "uuid": "4513bb2b-cacb-4cd9-afb3-10c2fd1e0472", "comment": "Malware payload (Sality)", "value": "583ff7c2add8b2b069d2fb0cdc14699aa4d9db58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774185717, "uuid": "704aed5e-4d06-45a4-a1f0-da7dd826ed26", "comment": "Malware payload (Sality)", "value": "9d2a0020a2e046c5ac6e5e4ed09c7a6096aa11c58612ef43d2c22b08a3d42c9de9cd23a3874a2878d113c2f6e2c35d7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185717, "uuid": "90db0992-89b0-4575-8a25-b52a56cf08cc", "value": "T1D105BF2139E2C076D2733170485DC35866BAF4314A3A4EE7B7CC67AD2F246C19B25BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185717, "uuid": "49c9fa7b-5e70-41c8-9333-3bef17d8cf10", "value": "a25cc0f2b07537e178efa8b6853f0de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185717, "uuid": "ed7c5b5e-e376-498f-ae95-fec1e06bf12c", "value": "12288:tLCdICnX25awdAYgvSV2xNj/3jb9mg/jxIWRV/TucqlcjqosFIxG3p:MNnXgawd8SV27zbsAjxxucqlcLsFzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774185717, "uuid": "db75c952-1651-4f01-a908-7baec411ecf7", "value": 820312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774185717, "uuid": "da6ec228-3813-4246-ad01-6b17d3be1512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774185717, "uuid": "f79d8e50-d30e-4809-8188-ff10801b2cad", "value": "f073b23d47e6147d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b184d6-25b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774160639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160639, "uuid": "b9c8883c-e1b4-49ca-a541-86a223c6823d", "comment": "Malware payload (Berbew)", "value": "0f497054f922fc5f27dec54869463100", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160639, "uuid": "9bdfbab7-2dae-4371-991f-0dbc0db52530", "comment": "Malware payload (Berbew)", "value": "f0ee966d7143355f041072769d721a66f838c23598485a8620c2a1a80e313298", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160639, "uuid": "33c844b2-5bfd-41d5-9db4-96e03c917cbe", "comment": "Malware payload (Berbew)", "value": "50769ac72977dbd0ba683245c50e6576b83553d4", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160639, "uuid": "dc9e2be8-5bd6-427a-b3f8-2e9a61ef84a2", "comment": "Malware payload (Berbew)", "value": "7c1aa064c5d73e8cccb75d723fc49ed16c9671662f630d1fade82c0298e0ec55cf361d5037f294d36d8bf9240becbeec", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160639, "uuid": "749ad517-5d4e-44a0-b748-5665ec2b6058", "value": "T1026452FB8EBA9B3FC41DD336E5AFCBA16153C0C701A6C56632305CD6A55F04728A2E58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160639, "uuid": "0873c471-3fd3-4983-a532-ba50cb5cc179", "value": "0b36fc85e0cb5e337c80982db5210969", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160639, "uuid": "df8c10a9-a926-4732-a85a-9a3e25cd0599", "value": "3072:zYA3Omnr8X5CrxdbMqlWGRdA6sQO56TQY2mEmjwCzAhjQjxNX+W5RKM:zRr8JwbWGRdA6sQc/Y+mjwjOx5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160639, "uuid": "fbc7859e-01f4-4bcb-96e8-baacc93d7a81", "value": 331948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160639, "uuid": "e37f6a2e-60ee-4e15-857a-cbb864da4ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160639, "uuid": "f27b1811-e367-4d83-9594-3017540df5a4", "value": "virussign.com_0f497054f922fc5f27dec54869463100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d42ce3-2601-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774192318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774192318, "uuid": "9c5bbffc-784a-4975-ab9c-6aba64131100", "comment": "Malware payload", "value": "d03e24e0e63ac54be4a1f4d5512bf5a4", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774192318, "uuid": "b4fa9af4-51ec-4fb3-9f3d-09ac4c1eeb6b", "comment": "Malware payload", "value": "f1a9a0eda11bfd9e62f5176813ddf29000f3f111c7f7aa13387c893c7415736b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774192318, "uuid": "bdcadecb-e45a-4811-a081-3fe3b10c68ea", "comment": "Malware payload", "value": "e15f1c9b669f6ad8d35dadafe288d66d4c001fff", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774192318, "uuid": "97e9f0d9-351d-4cdd-956c-f0b2f6f19cdb", "comment": "Malware payload", "value": "5357c0cef2c125406c75d248f9eadabfb1609785db91edc49d84f55d61b610d2897312d65cd890a90758e5f752119e3d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774192318, "uuid": "895855f1-71f4-4af3-bd0a-b4189f0bf80f", "value": "T130C333894D8AD8E88F2F705685AE5C8BDADD9102051EC5407A8FFD673F128E036EC7E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774192318, "uuid": "9ff94bd9-52b3-4907-8df0-0e493f02088e", "value": "768:G07uLxE9G6ImPeboE9hr8BSNTdyTPLesy5xxs9xuYpuFIfLzmDF84D+BCIUEZXFL:1gZD+BCB8yqT/TwM/RgGhromRXTn74LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774192318, "uuid": "f361de8a-9370-41a7-bc5a-286c173fe558", "value": 119109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774192318, "uuid": "bc4f9845-796f-45f9-9f16-008f3e6f5cbb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774192318, "uuid": "ae83bd04-2ace-48bd-aed8-00858f0cb990", "value": "Europe_Data_Stable_371.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841a52aa-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1774160984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160984, "uuid": "45e2f0a0-ad70-4295-a492-1d4c4279cf43", "comment": "Malware payload (Berbew)", "value": "c6d98a0e804d58a643aa275f99845eb0", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160984, "uuid": "c45ec03b-8ee3-4546-a9a9-2257c263f035", "comment": "Malware payload (Berbew)", "value": "f3dc06c21bd46db75341dd93fdfb0eec3e7864ce4c78ac19afc16de9d28d714f", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160984, "uuid": "2a4c8b7b-1ffa-4a36-ba32-b39adffb9662", "comment": "Malware payload (Berbew)", "value": "a2c30051adc3a418f5f08186079479d6bf288d42", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160984, "uuid": "3d3ffbb4-eee4-4c32-be8b-32fb697003f8", "comment": "Malware payload (Berbew)", "value": "f2bcbcc4cd3faa860e30552deed6256936381dff8615ab8af0363d901c6e1ca5b0c561c4b3c286df147eadc9ddf0b79b", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160984, "uuid": "81db4ea6-2fce-4926-b0cd-0aae9bc5fcee", "value": "T14484F142A6F27F5AEEA149B820735301617000FBC197B2B5B3E2EF313756BA1179E127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160984, "uuid": "fef3723f-9b11-47f0-b874-bd804d3595db", "value": "26babd76bbb7f9c516a338b0601b4c9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160984, "uuid": "611c65bb-fc37-4dd8-a674-534422091b65", "value": "12288:lyLaP4dwQZ7287xmPFRkfJg9qwQZ7287xmP:vwdZZ/aFKm9qZZ/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160984, "uuid": "86d487df-462a-424c-9e09-a42ffaa3b582", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160984, "uuid": "3d7d2761-ec8a-40d5-b811-7e280f35b347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160984, "uuid": "9d3039c8-6320-47f8-afa5-e9633c977875", "value": "virussign.com_c6d98a0e804d58a643aa275f99845eb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d35ac04-2604-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774193426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193426, "uuid": "00a5ea5b-67a7-4010-afd4-51d3e9bfde02", "comment": "Malware payload (Vidar)", "value": "a30a716e8a9724e994829eef19f5756c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193426, "uuid": "0b380cec-ed7e-49c1-b573-19996b8fc501", "comment": "Malware payload (Vidar)", "value": "f763b7475ff730f4e836dca3b934e9888c73cb5eb7047b3644c00370a72182f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193426, "uuid": "0e6e90b5-9dc6-4879-819e-914e88290ada", "comment": "Malware payload (Vidar)", "value": "e79ca30e64e079fcd422aaa01aa20adfcfdc6390", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774193426, "uuid": "87c58792-ab53-4aaf-b71c-c983ebe8edf6", "comment": "Malware payload (Vidar)", "value": "9d2279ace2120eb36efeb6633b212f61a7324b1ab688967ce8dadcfb1b884059efa6cfea7c2bf07364ef5265b77144ef", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193426, "uuid": "9a589b9a-bf0d-430d-8777-bd9300093305", "value": "T13B955C0BACA508FBD06A97368DB721957B70B8090F3223D32E916A783F757D06D39758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193426, "uuid": "208306e0-0c4c-400f-a9b0-fd2fd5eaac43", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193426, "uuid": "eeaa44b1-f860-4b1b-a616-d4125c64ab8d", "value": "24576:8tqVoU/HRmrdUy6S5/4Msffn89u7huJbgGsFhele5n923bmK2:8t0z/grdN6k/4NphudgjcV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774193426, "uuid": "eab3b2f1-0a78-470c-8a3b-13068a82cb72", "value": 1886416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774193426, "uuid": "9adc55ba-d92c-481c-bc84-7494c6e7db16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774193426, "uuid": "c229a98d-3c43-4daa-aced-cdbf3c9a854b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdebc462-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774161081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161081, "uuid": "aae4b252-fd03-4004-ad31-3b52cd523af6", "comment": "Malware payload", "value": "e6fa9bf97a6a1632d4691a709b562870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161081, "uuid": "895c5ee0-ede8-4d7c-9de9-0254c5956a60", "comment": "Malware payload", "value": "f788b967d0ac04e8f03548982b38e0389015d5465b25baa1efbe446a3a87873c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161081, "uuid": "ed01b4d7-4a49-496a-a319-f9274aaf3752", "comment": "Malware payload", "value": "beea95d429f2dee4b94b28baea4d8e7ce08a97c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774161081, "uuid": "19d63e6a-3eb7-458f-aea9-9545086ed5f8", "comment": "Malware payload", "value": "c0978a85a51ae35652aef9fc45e5a6a09f28e9c9d5148bf26ccf95d05a292abe7991f630bd82c07ff971409da276621b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161081, "uuid": "baa92e59-0e8a-43b6-9ed0-64ca5b94001e", "value": "T142645B12EEB44C77E060073D0CF4AE23A93EBB661931945A2AC50BD9FCB96715D2472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161081, "uuid": "2f5e60df-864f-410d-bed9-37f6b9adb6e9", "value": "e0540d8d3642aa213356c25abdaaa353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161081, "uuid": "fb070d2b-db07-41ce-b69f-03d9a04bd48b", "value": "6144:sVy+e85ZWW2NMwUHUPRT6w98Oi/ftj+p+agPamuRD:sUW2+wU0Li6yamuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774161081, "uuid": "423a9188-ead4-43f7-89de-d5a829e415f6", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774161081, "uuid": "07165902-3e89-4701-97fb-81aeb244a60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774161081, "uuid": "ebfa57ef-a2f9-4efb-8e77-398a0ce3a5d2", "value": "virussign.com_e6fa9bf97a6a1632d4691a709b562870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e652bbdd-25d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774174463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774174463, "uuid": "5cd34fcd-abf4-4378-8c59-4b1990cdab45", "comment": "Malware payload", "value": "64d2721aa50ca622721b05c8abb4e5b5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774174463, "uuid": "f6dcf2b9-3625-4d45-bf0a-82a1109845e1", "comment": "Malware payload", "value": "fce8bf1d34358573a4d16364c841d8cffcead421e530c1557ef1333344651175", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774174463, "uuid": "049e8f05-02e7-471e-a663-072761359547", "comment": "Malware payload", "value": "aedf00eb7ef15b4e04323df1cbc04d60825af7ee", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774174463, "uuid": "8c2a1b81-ee47-4406-a092-a165d44e2f8d", "comment": "Malware payload", "value": "d2d315e165413df3734e5c2c16a8b63c5b2f23ee2051918edc395f30866cb72c2d77badaa89a37edc18e9a6e4a1edeb7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774174463, "uuid": "f4cb2ad4-78cd-42ba-bfa0-73687473b385", "value": "T102B3529B4F8E44F8874A2478895F5D07EAD99201351FD4A0B64FF9C4BF3B93E60A24D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774174463, "uuid": "524522fd-a310-4785-9733-7330942de958", "value": "1536:cPP9rIKAIlAAIwC3XAV15O58oToafHSGEJ3iiSwm:eW97sW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774174463, "uuid": "024c4f22-a3b0-4305-a2f4-bcc2051446eb", "value": 110058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774174463, "uuid": "72e2b504-f21f-41cb-a25b-c35eaff689c7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774174463, "uuid": "a7d9dd66-162a-4e84-b44f-85e450d5e8ac", "value": "Office_Backup_Secondary_182.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1666f76-2624-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774207553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207553, "uuid": "d495d106-5ded-4d78-9625-d12ed43a03af", "comment": "Malware payload", "value": "d050c6e03f7d5d4e1cdbda9429e5c855", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207553, "uuid": "4b9862ba-2fa1-4c9c-a3cc-3427583bad51", "comment": "Malware payload", "value": "fdad2f108dcefa145a1c04a3c87436af85a47696bd5c1dd1bf790bb57e3e5bbf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207553, "uuid": "fe89eab1-954d-44c0-bc4a-273f98eb1db9", "comment": "Malware payload", "value": "d77aaf6c6ac8b575c65da2df21fe8cdc4869a6a1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774207553, "uuid": "fd5899e8-50d1-4c8e-94e5-b7fb8089e6eb", "comment": "Malware payload", "value": "f88ae4830dda616e37b706081b40ab720f30ccad6be13792c321e3798fdd03f875c24c208abfe7b0266c8cd0d1682882", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207553, "uuid": "d6be0d77-f737-4a4f-8035-f201063420dd", "value": "T157F4F1567BB31247EB7E163D48AC4702A7F0EF67E9AAC54B03842915A4778D38E438DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207553, "uuid": "11ebe5d9-b65c-4ba2-bacb-ccdcd7c8edaa", "value": "12288:PhN4a76rwGq4XkpdiPFahH4geW5ZbLA5WteXJaz9rP9DZOT5imV+eJQWZ:5f6kLnuF2HcW5Zo52wMz9r1DZOT5We/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774207553, "uuid": "7f44e941-a45a-44af-ab2d-c99fe562d39c", "value": 738170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774207553, "uuid": "801a3087-b4ab-4c97-9d8f-959e0ef19123", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774207553, "uuid": "09e99ee0-ed1f-463f-b230-b1df198b9717", "value": "DANGER v2 MADE BY PbCat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4788b92-25e7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774181252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774181252, "uuid": "a6d83a46-6670-4e05-ab5d-959e27ecba41", "comment": "Malware payload (ValleyRAT)", "value": "a6c5ddd9395b5048edaf803d77c1f421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774181252, "uuid": "aa4dbdbb-9858-4ee4-9b4d-0d7f7bfa5cc5", "comment": "Malware payload (ValleyRAT)", "value": "ff53f6208eb91890aedfc7e51b769f2c2aca95c985000ef9ddcb32e16d2a6788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774181252, "uuid": "6d4a3d96-919f-4f4d-837f-1d27574250f3", "comment": "Malware payload (ValleyRAT)", "value": "b1575ba9e3f6a3c22f803e40b3e23690ed7303ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774181252, "uuid": "502eec5c-8c93-404c-936b-27542a9f0360", "comment": "Malware payload (ValleyRAT)", "value": "cdfa462369deeb1a284f898d89a8c022c69ce52836093bb11258cc6dc5c05df60ce05f2b9c547fc7dec27792e7214ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774181252, "uuid": "76b66bf2-06ca-4863-9141-4fb05c28f171", "value": "T1F4633AA274DA8133E89362BD0FFCA2B1559EBCC0177640F334881BED97752D58A39366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774181252, "uuid": "897b85be-0626-498b-9f38-1e1382e9a4f8", "value": "7aea8e332d822b58214e762f4410c778", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774181252, "uuid": "b998fd9f-6df9-43ff-ac95-e4c9bc5da677", "value": "768:Fzev78lXh0sag+jix41UjnCh+Y8S5rFj0Ok1RUpED30xJHCLBpKC:Fz3XmWe+AJ0rRUl25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774181252, "uuid": "496026be-e485-4b42-bfb5-b240d4a52efa", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774181252, "uuid": "b9d766d7-c14f-4165-a720-4b7df980fb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774181252, "uuid": "734c85f6-a9f8-4b62-8cec-67e43d509184", "value": "77979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2cba3a-25a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774151711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774151711, "uuid": "d62fe561-7eb1-41bd-96e0-67c2f3fb342d", "comment": "Malware payload", "value": "b24dab2bfbd7295358b5e5cec56875e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774151711, "uuid": "d2ddebed-fbb9-45d7-85f6-1a6af2c32e3c", "comment": "Malware payload", "value": "ff5547d9ed54b2b43b4677d3785aa44eafd8cc8d91340a56c5a3dae24d3a4098", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774151711, "uuid": "d6aae4b7-5b5e-4c37-aeaa-425ebbd58245", "comment": "Malware payload", "value": "f4fbbd9568fb98533067ccad9961f9b226990b35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774151711, "uuid": "e685a302-a40f-48c1-a830-fa46433d3b79", "comment": "Malware payload", "value": "bb5ce27953bc188a47832160a1688a5d573a3e891487ca058e525dab209546dd184614bd6402573d6bdebb70ad8a27fd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774151711, "uuid": "331567ae-e124-4ea0-aa65-c2b5f52c61f1", "value": "T1B7925CA916496C79BBC0DE7D9F3C7F0CADE4C1C02218A3ACBA4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774151711, "uuid": "a4b9c047-6207-44dc-a9af-037fbf782e9b", "value": "384:A/0M3vgRjGlsaq7czsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:ArmjfgzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774151711, "uuid": "120470ff-ef7b-4ed4-9206-10c35ad1c8c0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774151711, "uuid": "bba4e823-37f8-4ed6-894a-8b5a503be8fc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774151711, "uuid": "881641dc-e2d5-4e35-86a9-d0fc1a785ec3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cda5f93-25b8-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774160999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160999, "uuid": "27374e21-c23a-49f3-b73d-8cb2598f7727", "comment": "Malware payload (KawaiiUnicorn)", "value": "ccef3ef89643236fdbce9213e4848f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160999, "uuid": "8f38822a-ec60-4241-9da3-284c1e89af0a", "comment": "Malware payload (KawaiiUnicorn)", "value": "ff99e74817543693152b8a7090aa7d23ac57f67df6c613d149c501ea03382fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160999, "uuid": "31f4cc11-4e8a-4154-a9cb-d7ac3427a4b3", "comment": "Malware payload (KawaiiUnicorn)", "value": "fe2740b07e179c8648329392620b420ad548566e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774160999, "uuid": "4cf3cabe-8781-4b79-8af9-6a4a62f0bdf3", "comment": "Malware payload (KawaiiUnicorn)", "value": "ad9b89113247da58926ceaccaf8c3e74caca9629734f99fb123372b9252f4a63da36447318ae91ad27f971f8d93b48a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160999, "uuid": "ee412b22-e504-42b4-bcd3-38755ff731ec", "value": "T108A4A5929C64AF46FE16453423A56EBA404E7D2F66E4421C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160999, "uuid": "e5fb8c7e-e3f7-4411-a07f-a753db5f3b85", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160999, "uuid": "abaff085-431a-48da-accc-314f1e23389a", "value": "3072:3+4nogeojS8U2bycPjLQQf8BKDhiHILOPJHByulsJXH+NhvGj2lu:3+wokrU2JPHQQfEWy8JXe7vGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774160999, "uuid": "81e9e112-8cde-4c3a-93fc-a86c77b83e73", "value": 479246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774160999, "uuid": "c6a2b7ec-341d-44ac-9f74-43af56670f7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774160999, "uuid": "bada86cd-5fb8-47ae-88f9-afa6f3b0b156", "value": "virussign.com_ccef3ef89643236fdbce9213e4848f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd54c19c-25de-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774177508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177508, "uuid": "ae1571d3-41da-43a4-b443-895ab245a399", "comment": "Malware payload (njrat)", "value": "01c38eb7f66b7c99fbf0a89d52ff1e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177508, "uuid": "aa777f07-f751-4f49-b817-81b46c950e8e", "comment": "Malware payload (njrat)", "value": "ffd8b2b01102c4accc78dc6fea204f487b71f2eb6023651fa80fc42bdcb906fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177508, "uuid": "e5b170f2-4c56-407b-b239-9dc67e8ed8ce", "comment": "Malware payload (njrat)", "value": "4728c834c541ba951f5c60b61024ccbd12653b76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774177508, "uuid": "bfe8e07a-2691-42d0-b89a-d8bc674dbdfc", "comment": "Malware payload (njrat)", "value": "d53f298cee7bd6ecb5ceb2276893bd153dc4f94e5f0eb47c8d42de8bbf691f4dcb54f6af54a7c1bd9751befc17ca871b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177508, "uuid": "47109045-d90e-4def-ad83-7d02c49e4cbc", "value": "T17F634B4877958A15D2BD2E7844F256518730F60B6D03FB2E48D160FAABB3FC44A42BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177508, "uuid": "426b309d-1d01-4018-8a64-342b15b0c40e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177508, "uuid": "bf30d486-786a-4916-8148-fa286ed8579a", "value": "1536:+ZqU4UoN36tCQviFw1c25y+BnvbYfLteF3nLrB9z3npaF9bHS9vM:+cU4UoN36tCQviFCl7BnUfWl9z5aF9bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774177508, "uuid": "48860f69-9116-463a-8f01-70b610f4b252", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774177508, "uuid": "3e1776e1-3381-4277-8f12-b904a0fc6e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774177508, "uuid": "ee274757-68db-4774-bc1b-046cfc42001c", "value": "NewClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }