{ "Event": { "published": true, "date": "2026-03-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-01", "timestamp": 1772409781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3ce7d9b3-e4b6-49a8-87be-ed528c2a5774", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dbbfe4-1573-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772372205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772372205, "uuid": "c58bdd99-bd8f-4a81-b1cb-409149ae43fa", "comment": "Malware payload", "value": "b3e8c179a7f62860e110c2d0ba2a771f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772372205, "uuid": "38d43b72-9cb9-4d70-b626-8d329b4c821a", "comment": "Malware payload", "value": "02327b06d4ab9453914c9beae25e2648a35ec848aede39091ce4cd8c53639a7c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772372205, "uuid": "b3c90eab-00eb-419e-8d0a-b44a46e674f9", "comment": "Malware payload", "value": "fdc8a61f1d3e55d4edd8dbfe3eeb67b9cbc871c8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772372205, "uuid": "4c1e158e-03f3-41a0-b437-7e8aa8663847", "comment": "Malware payload", "value": "0a9033c104934b944686da13ab4c3983117880ab4759182648c5467338cb2d3a2626e2ceec9df88ef465a9185e0a4557", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772372205, "uuid": "90f70d75-839a-464e-9265-b5d252869b87", "value": "T199F0E14410E07CB01BF85E0CD1DA854D52757722F5A73E3471E0D6E4062B4407359B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772372205, "uuid": "39a1f7a8-db81-44bc-a328-bd852527469f", "value": "12:MquhRnFxvhsjuXtW0mq8YQlkmyS+6EZ8YHj6X:MfnnDhXW0VfQlki+DFD6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772372205, "uuid": "5f85d177-22f4-4243-a4cc-143c2baa1aa4", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772372205, "uuid": "78047f45-be67-444e-946e-906a9c4cad45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772372205, "uuid": "888c3568-279b-4bb5-aa11-3caebd91386e", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4d2513-1550-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357028, "uuid": "030ccf42-5a1b-4eac-bc21-180b5700ebaf", "comment": "Malware payload", "value": "38a2c0dc18eee997d266e64974025c8d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357028, "uuid": "c4c03514-9591-4a3b-b2fd-dbe5a797cb1b", "comment": "Malware payload", "value": "024cd5104ebed3fb749352f9adc9aaf5a31d6fa83dbfcaf2ec827208a67b5d16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357028, "uuid": "f73d83d4-4880-4ff0-b112-e4409e868257", "comment": "Malware payload", "value": "4002299d1e3ce877db0a540318cbfec1e7357846", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357028, "uuid": "9aabb9a3-f913-49ee-857d-0e3fdb23019b", "comment": "Malware payload", "value": "bf551db9215e0c572e28dddf6c6df92941596abb21946da3d00f38e5e78ac9c469fb7abe774af4920e6556c678fc3d3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357028, "uuid": "80d415a3-b3e9-44d8-9c04-a6745249408c", "value": "T186E0F12478C8D0CC650123CA6288C709A4E340D43F04F4B25B49C3DCF64323103984FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357028, "uuid": "e85ed645-da48-4586-87a0-434ba1150fd3", "value": "12:qRHNkuqrw6s+2M87UxMbedO89ojALqWNHF8E4:qrkRjD2dgWkOpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357028, "uuid": "03bb2d51-7b64-4711-89d1-39d333c08dc5", "value": 405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357028, "uuid": "8c97464f-49b2-44ec-8295-b8ce42514972", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357028, "uuid": "3503a121-4404-4943-a3a6-d542f0fe033c", "value": "ofsymyb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e887f9-1510-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772329591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329591, "uuid": "65e032d3-8287-4954-b247-8e8336fa4393", "comment": "Malware payload (Mirai)", "value": "0f35745378761b33bd98c2d21634c331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329591, "uuid": "7cfc2040-06ca-4196-8886-7abba106846a", "comment": "Malware payload (Mirai)", "value": "02b2bedd56fd8cfb36d46de5fbd168d64c0bc99010fe329fb6144ec46bf91d09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329591, "uuid": "be2b89c9-a300-469e-b42e-0b1276746c4f", "comment": "Malware payload (Mirai)", "value": "3b0023a430620987cf0fa242f53fbc5381f6834b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329591, "uuid": "c80a61ef-684f-46ab-9fcc-a08d6e86ad17", "comment": "Malware payload (Mirai)", "value": "7d800ff479153d4acf42163c6a1947a4f1cdb6f334342a36f66fba68b829965e002ab81fad6f8214e1583382f9d6c44e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329591, "uuid": "aaed6e27-44c0-46cc-9493-2e1f2e694b51", "value": "T1B3E34B55B8828A22C9D513BEF92D018E331327A8E2DF7213DD105F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329591, "uuid": "344f6830-aab4-40ef-b41f-04663c650579", "value": "3072:MNkU+vbx7obbywHU2ADFut18CaMd7zyE6+GCoekO:o+RobbyuU27tqCagY+GkkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772329591, "uuid": "637d3568-8747-4885-863d-4538ead88485", "value": 145528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772329591, "uuid": "e337b3c6-7510-41a3-891a-fcb8248e389b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329591, "uuid": "7866f5fa-7dc5-48b2-a6f3-6ded2a99cccd", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cfa496-154f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356535, "uuid": "673757f6-8521-428c-b38b-9c09b22c8465", "comment": "Malware payload", "value": "3f69857166135cb050f950344a3cb9f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356535, "uuid": "0fc62dbf-6dfa-4eae-85c5-46bee1f36c63", "comment": "Malware payload", "value": "038de133c7851de6114b5df6d19bbe8815a977c488b6efd50f050e013f2fff70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356535, "uuid": "fdc9a901-6c99-4a2f-b40b-e4b85ac2e0fa", "comment": "Malware payload", "value": "56f238db5eb49c267bcec713390be6959241db8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356535, "uuid": "538013ff-048b-46db-b6a5-8ee54c6af2d1", "comment": "Malware payload", "value": "c34b3a9c37d57e71e39ec4fc066c00cfdffc664039c61ec467069554ee2abcf392bf241a9a9770ab7116746aae5dd0bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356535, "uuid": "7ccf49f3-ae08-4e1c-b270-e6ab65dd0c41", "value": "T18508D01663A116AAD97BD1388AAB6503EB73B4071330C7DF329C43712F63AE45D7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356535, "uuid": "933ec679-9829-4e2a-bdd9-029f0906d089", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356535, "uuid": "aab08629-dea8-4253-b8a8-f850b207298a", "value": "786432:a5EosxTUU8XOkBKgPQYYURVjBWV1CVucwoz3fEUhWABRWYF3eKE6Av0kdIhc/4kl:a6oslbkJrYURVjBK1C9PvWIOYAvldIGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356535, "uuid": "deb7c77a-1098-429a-8647-bf4563ab7ed0", "value": 80848917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356535, "uuid": "6f2b4046-6cd3-4d89-bdbb-03609b790407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356535, "uuid": "d6f7ecf6-3dea-4e9d-9f0a-e3b15ad72bc0", "value": "038de133c7851de6114b5df6d19bbe8815a977c488b6efd50f050e013f2fff70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abd6f50-1569-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772367739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367739, "uuid": "0388bee4-447b-452e-9535-9385f76aeaab", "comment": "Malware payload (CountLoader)", "value": "30ce1e4b80da8ded9cdde1be65c2fbd3", "object_relation": "md5", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367739, "uuid": "da1a6779-b8e9-426b-a4ea-434e85fd18bc", "comment": "Malware payload (CountLoader)", "value": "041214997b5ba9f3b344f660d1ab8542b76473538ebc593f78abfd8cee72b7a5", "object_relation": "sha256", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367739, "uuid": "54d98327-29e6-486e-8246-9547d12498fb", "comment": "Malware payload (CountLoader)", "value": "5c0a732f1ae17ba470e049689ddb63424aa5f6bf", "object_relation": "sha1", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367739, "uuid": "055a53d7-0b37-4174-b6ea-7ba5d2fd26f4", "comment": "Malware payload (CountLoader)", "value": "e7613f0a9d1be32789982be6f21afc5fb3dd050b6e5ea4369056fb12d7b1af23413081017ae98373186bccd45e456dfd", "object_relation": "sha3-384", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367739, "uuid": "88c10817-800b-489c-b1c6-5834bc4daa10", "value": "T17DD52256ADDD54E6DCF443F1909332B20E353C3983BD09AF3598B0295BB2A91CA37B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367739, "uuid": "9126ae20-a29f-419a-87c4-900e4b29e017", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367739, "uuid": "6a59d11b-81d7-42b8-a7c6-fb9eb79feb66", "value": "49152:ClRltyG45DARVitofpdJP+xxUkQH3M9DPf4CguAyHrpllQhvDW:ClE5MCmxd93MloClllQdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367739, "uuid": "53cd4d5a-0066-483d-a9fb-c782bea141a0", "value": 2966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367739, "uuid": "5c71b017-82ab-4e4f-9547-3c397cb8672c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367739, "uuid": "a0f2c840-462f-45e7-a43f-a83862940954", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718b3bcc-15a5-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772393574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393574, "uuid": "9a589bcb-3a11-4955-b7ce-5f123095b054", "comment": "Malware payload (SalatStealer)", "value": "c457936a35f6f7d7b058fec49afb5961", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393574, "uuid": "d1a6d9d7-a7a0-447a-90c5-99ee492f6637", "comment": "Malware payload (SalatStealer)", "value": "042ee2cab553712e2ae67754f889e03807049feb9848228ad753b3d4725b9dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393574, "uuid": "f872e13a-9b07-4701-b9ff-56c0f2b1d518", "comment": "Malware payload (SalatStealer)", "value": "98f20a656a3fe35b90a5c036badff209f94fabcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393574, "uuid": "3f8698f3-ed78-44e5-82bc-ed33c8bcab82", "comment": "Malware payload (SalatStealer)", "value": "af7c0779751e92138f534dbca3a40db27d002df64bf364d1edd2c02bcc681b5de7e69c0ecd5320a67681cb567348caf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393574, "uuid": "ee63b4ca-1478-46a1-8c1f-795359e2ae1f", "value": "T146E533F3514445FCC45EA03042868E4EAEB6D5305D828E57FA37105DE9A3EACE2E77B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393574, "uuid": "187551bd-2043-49eb-a438-777f6aef8699", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393574, "uuid": "cd169448-5117-419c-86f5-911bc2dff430", "value": "49152:b5MelRDFuGTdqNOKRuOiCdJH57AodVOoHPIbT+wGBgck9kxrxsGE2iAi/j06lPHd:t1OwKRug3H57eovIvfyPXaj1P9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772393574, "uuid": "be8fb72d-db9c-4d88-a559-f456afdf6297", "value": 3296256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772393574, "uuid": "37b55242-b5e1-45c8-b05f-ca34bcbdfd0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393574, "uuid": "95359f8c-b321-498e-b2e3-8294db305ada", "value": "Velocity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c53c43-1517-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772332760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332760, "uuid": "595067b6-e65c-4986-90ce-22b4628ec265", "comment": "Malware payload (Mirai)", "value": "5d8b65ac3f87b848f77cc1de67eea0df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332760, "uuid": "be8fc006-99ca-4a3a-8849-8a1a449f3228", "comment": "Malware payload (Mirai)", "value": "043956077b6789306afe0178a539047e6d7547d5c59915863b5a22020048193b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332760, "uuid": "10552ea0-6985-4f31-8bfc-33eea87adbe7", "comment": "Malware payload (Mirai)", "value": "416791139d0bb4852fd60e5e68f349ec48abb22d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332760, "uuid": "2b5650bd-da19-4f39-9f67-c6935b3677a1", "comment": "Malware payload (Mirai)", "value": "a5d9569f89c09ad17b3026bb3a9308efdc8e4aabe6ef2f06c5cc6a3c21d7604df61d30ab8af0356bc873ba577923a2be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332760, "uuid": "99624cb0-e967-467b-b788-c95aec32a48d", "value": "T1A3231A9AF801DDBEF80AE37F8857090AB231F36501931A3163677517A9372A415B7FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332760, "uuid": "b6ef2f5f-f933-4177-95a8-1f6b5372b1f5", "value": "768:cYnPTm54BT0jZ8jaz8l3JO2LJp8lbDq4en7y1vH8gjI9:5rmST948lZDLJp+bD1en7y1vcQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772332760, "uuid": "0c6f4c04-55da-4d1d-82d4-ea59de94f3ca", "value": 46352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772332760, "uuid": "cdef262a-f05f-4c58-8254-9fcf746a76ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332760, "uuid": "783c2627-f38a-4437-9525-83e576f76c39", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1cf104-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396813, "uuid": "588b9711-d0e8-4d9a-9c56-948d63f78209", "comment": "Malware payload (Mirai)", "value": "662edf4aebf698e89684ef0a5cdbc31c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396813, "uuid": "2f39866f-894d-4f31-ba9a-50a58c85a717", "comment": "Malware payload (Mirai)", "value": "0466b095a3a94b22493ede62e646d9df6e5c8d075f19a060142ce917c5a793f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396813, "uuid": "6a179023-bb91-44ae-8458-f3742c23bd5f", "comment": "Malware payload (Mirai)", "value": "6a3573243577d68278ad756c1a9cc568e52a89cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396813, "uuid": "a0c6b679-1bfd-479d-ada0-8ec551e9761b", "comment": "Malware payload (Mirai)", "value": "305d2807cf93f81d4742ff31f9a73bda50080791fba83c76dabe727d95493c081bc0298013cc04689cf453c6e4594836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396813, "uuid": "f0b7d804-ec94-4813-bec2-a9d1474460d0", "value": "T14F14965E7E22CF7DF668873047B78A20976933D626E1D644F1ACD3181E2025E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396813, "uuid": "2ab2bb78-2d82-4f0a-b10d-555ddf0b826b", "value": "3072:CVaQY6iDYeIg9sZW2ViQ676iw/3PJr+9e50Z8hKVxnh:CVaQYHbTac6T35+9eiISnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396813, "uuid": "938a5f92-935a-4721-a303-0c6ca595cf98", "value": 208116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396813, "uuid": "841b3753-792e-4a65-9ba4-246d9643ca5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396813, "uuid": "4bccb688-b46a-42c4-90c8-df1268c843be", "value": "csk_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0900179b-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357321, "uuid": "74f5dbe5-4050-4168-9b15-541381f2c303", "comment": "Malware payload (AsyncRAT)", "value": "ace6c1d90f264ae9eb71adf0965bf510", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357321, "uuid": "aab83bde-33dc-49cf-aa02-c430daff7c8e", "comment": "Malware payload (AsyncRAT)", "value": "0481f24f74bd4797dd1d172bce20125c3ee223dc96bce5e7974b04047a789377", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357321, "uuid": "81986b3f-3503-4a23-bab7-c1a55453b618", "comment": "Malware payload (AsyncRAT)", "value": "8c9d10d483e17a8b76e7dd7f0a574a46b3b7daa4", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357321, "uuid": "570fb400-203b-4680-8377-886975f00591", "comment": "Malware payload (AsyncRAT)", "value": "6f51070a724169da3b3dd49bc32f5f549208833dbac68f806401d88a1e2f3a9e84a493283dbb62cabf6743e97721f5e6", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357321, "uuid": "3313abeb-c70f-4870-8942-585fe5b1c7f5", "value": "T1575633E8B1BBCADA5C4CE5E9428D6D8EC9C1716C25C5CBA947A3E5EDD04C7C8EC2190C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357321, "uuid": "57ced47a-d050-480b-b3f1-286ed110d450", "value": "196608:1fN7J6va69IBRbVPNC7NTHPNBknQsUDp5n+IB/w:1F74j9IlNWzNBknopVxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357321, "uuid": "c3610d42-8235-42d7-af86-2631508094ae", "value": 6429288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357321, "uuid": "1cd034c4-36bc-4408-bc79-5215e5f70d29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357321, "uuid": "3043c9dc-98de-4f0e-8a1e-0d7beac0ab03", "value": "0481f24f74bd4797dd1d172bce20125c3ee223dc96bce5e7974b04047a789377.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f2ec02-15a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772393959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393959, "uuid": "0f139ba9-9475-46ec-807e-58fcc56f541e", "comment": "Malware payload", "value": "5eff67756df12b9a2cbce21938773b2c", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393959, "uuid": "144d5e0d-af21-4442-a451-868c1372ec9f", "comment": "Malware payload", "value": "04cc7f4d2890a99937a02f091e2f47cae4bb7ca7083f7201255c14776aeb1261", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393959, "uuid": "d2dd90ee-a3ea-43da-857a-b1b314149bef", "comment": "Malware payload", "value": "383b06f62d1f5a286a34e6b223c1f830ba85926e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393959, "uuid": "495b2c85-286c-41f1-9aab-46381b1b7ae9", "comment": "Malware payload", "value": "81fe5e6d1262b9bccd0d8f0c95be794a0f11a44e2e8ded96dd9cfa90d01a6520b62ede0d003aa2bd9c122c2852c46f06", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393959, "uuid": "7bac0a53-b730-4124-8cd6-c56de37f3696", "value": "T1D77723E8EEDBCED8AD9DF8703DDF07D0285096CAF223844552D9C678E343A470A519E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393959, "uuid": "0b7e99f3-8e2d-4e7e-8e39-1efbb57ac9cb", "value": "786432:KS0ug+2bs+L+7fyCr13FiVLoGkM8Bl3CK+SXq9VUgvVnV:KCN2bhL+Lya11iSY8zYnvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772393959, "uuid": "da7bebde-b1cb-43db-ad72-014d1c530dd6", "value": 34261095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772393959, "uuid": "eadcd4bf-7e62-4960-82aa-6fd7c6818acd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393959, "uuid": "d9821196-6834-4117-9c42-2c44933fcf54", "value": "consolelofy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2b5a23-15a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772393642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393642, "uuid": "c5063781-8db2-4943-918d-8ad883e7feee", "comment": "Malware payload (Mirai)", "value": "910db8e1885a79ff3e83476ddc584fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393642, "uuid": "73539eaa-c4ee-4652-9309-5217c1b3e736", "comment": "Malware payload (Mirai)", "value": "0545501ae9a5f5c69daf71e77b5c756b44d45760ccae2e40cfe557a177921734", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393642, "uuid": "e3b9840c-ff0f-4715-8662-1b6ee4883e82", "comment": "Malware payload (Mirai)", "value": "2cc5616bc23b1ab898250cb3e124994016e2f4ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393642, "uuid": "f861892d-f00c-4a81-867b-3f89716c6eab", "comment": "Malware payload (Mirai)", "value": "c19fab87887967c7b02370e8c819f4190f66a8ce22c01ad89249703c8e091b2e42c4def8e20ea82cd5b39db69ac4f534", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393642, "uuid": "628acbb7-3490-44b1-8b01-5d3e5dcdf04d", "value": "T1A4F31956FD819B11D5C152BAFE0E428E33231B78E2DE72129D246F747B8A87F0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393642, "uuid": "8ca43b5f-8656-4c67-8819-1fd6453d9732", "value": "3072:wK4kLdRzLuixdTrBQnluAdRQHlZqBXWktkaBuyZn+fNioSPlPybEIOuKkU:Z4kLdRuixdTrwfgoXWkqa0yVVoSPlPpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772393642, "uuid": "a373cb79-2e0b-4345-b1c5-d10ef781d4ea", "value": 170836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772393642, "uuid": "f7d910ee-4c40-4f9e-ae0b-d9903f3da463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393642, "uuid": "d6f8a41f-54a9-4d3c-9d9f-d82545a97883", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0189d68-1553-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772358567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772358567, "uuid": "5b0d0c5c-f636-4d0f-8b52-9220ad5d7c16", "comment": "Malware payload (Vidar)", "value": "1138fd03ff26e2891e6db821ddb0e02d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772358567, "uuid": "d64a5b44-1ecf-45ac-acd0-caedd18a471a", "comment": "Malware payload (Vidar)", "value": "05e92880112a00292ed31f8cd3f0679f7c0295952f3743af2285eedfdf5155d0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772358567, "uuid": "17c123d0-ade0-47de-a828-d3f8b681bd75", "comment": "Malware payload (Vidar)", "value": "ddbc017257a874acff7f911b9478cd0377ed56f8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772358567, "uuid": "aaa346c7-54b2-4159-bfad-51836ed72aab", "comment": "Malware payload (Vidar)", "value": "19a5d9bccd91a82829e2f0c75cbeb79e81e00495eccc57609e9f3ebe372c4771f0138aa764a96ec831cda9e0e705b39b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772358567, "uuid": "0883b9fa-46bc-4135-8cdd-f2bea6439a6c", "value": "T1CEA6062BEE648268CD59913BD0A38F47A9F370B50F3ACDEB214307996B859C05D3E725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772358567, "uuid": "7df93182-9889-47b3-a2b3-a83d796d4392", "value": "2549ebf941b5f40c69593fdeea32a946", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772358567, "uuid": "3fcd4622-ac43-4fa9-ba57-2e5347971280", "value": "49152:Aa6jgnfQVCpf+DYEuUmK1N0TqUacS1+UySCFLgpoQB5sIR6l3x96WoeopFN4Xg66:ASwUK/xaHoeojNEZPjq3X1O/aUPgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772358567, "uuid": "b23b3021-7233-4de5-8122-d51bfdf02c30", "value": 9646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772358567, "uuid": "e4674f96-bd60-4908-a289-8c899ac8915a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772358567, "uuid": "ec10c4ee-280e-496e-96cd-aae054e44745", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b18e1c7-1569-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772367847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367847, "uuid": "9a3f9091-b0cc-490d-87a4-2362cfc6ddcc", "comment": "Malware payload (Smoke Loader)", "value": "9983c9e4a8a92439555051142a797294", "object_relation": "md5", "Tag": [ { "name": "217-156-122-57", "colour": "#7EC429", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367847, "uuid": "e6c5382d-7197-45aa-85a3-55812fcff025", "comment": "Malware payload (Smoke Loader)", "value": "06bd471ea00320a2172fa5da5c0c8564abb02f8420264d5dd76cdf8ac39bca1b", "object_relation": "sha256", "Tag": [ { "name": "217-156-122-57", "colour": "#7EC429", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367847, "uuid": "6de62560-a95c-48cc-a1d4-5b2e0989ad12", "comment": "Malware payload (Smoke Loader)", "value": "e2ad56ebcd5b1bec4824897d6d7e017942851af7", "object_relation": "sha1", "Tag": [ { "name": "217-156-122-57", "colour": "#7EC429", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367847, "uuid": "4260cbe5-4d7b-4fa2-afc2-567e40f86438", "comment": "Malware payload (Smoke Loader)", "value": "fe0577d9c4b389b4d574f57796677d51e81664bd3f5a4f60b4542d7740ec87c92db14a324ba190e48bc4c7dc3b9d8fee", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-122-57", "colour": "#7EC429", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367847, "uuid": "e3b1b9e1-da2f-4a2e-90e4-a5c02e4b2eee", "value": "T19D77AE1677E84065D0BB9238897B9756E775BC210B3097CF2250BA6D2F33BD05E3A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367847, "uuid": "5be24712-f21b-4478-8f4d-bdbad43db176", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367847, "uuid": "08abcc2f-dac0-45c3-bf7e-740a35de2716", "value": "393216:i4WuTSlDCaviSeQXjsqMDSmIg+0+QYFtSP4Ii3bAQBY:i4WuTsZhXjNmIx0tYKP3nWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367847, "uuid": "eec07826-8999-444d-afb2-673de45a9449", "value": 34418688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367847, "uuid": "74d1432d-d99a-4086-9fd1-cbce1af6d1c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367847, "uuid": "e422bc75-601a-48f0-8aa8-8db8725cbb0f", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf2ce7f-1594-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772386292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386292, "uuid": "cc592f83-9655-4b07-806d-e077b666b888", "comment": "Malware payload", "value": "b7e646c690fc4866430db8c74a1bb6a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386292, "uuid": "52739323-cee2-4fa7-a791-fbcaa1704009", "comment": "Malware payload", "value": "075eff4f83b0a2267697d6d12db4cf4fa2c232b8f3938516ac4771fe95b9e630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386292, "uuid": "4eb9970f-f101-4392-add8-fa4b03a30a36", "comment": "Malware payload", "value": "3abe326b31c5f75a49cabf314e4c22a6983d9e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386292, "uuid": "6a1ae5f5-1541-4d98-943a-4ba98560cc28", "comment": "Malware payload", "value": "2f461b31312801e3d7bb1f234dbeb79abf0a4dd0facf1429100e75ae999b05fc460e5795ee5d3339269fa38e9f916740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386292, "uuid": "2ebcc662-e231-425a-9d5e-aafe3e94f4ff", "value": "T120A623FE72583318C406CC785533ED0AB2BA125E06F5D9FD79CBBA80ABAB410D645F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386292, "uuid": "2bd46160-02f1-415c-986e-538d2d19f737", "value": "0b1ceca18c76660f2e3756979d6fcd68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386292, "uuid": "2d36c9d1-77be-4d7c-8d43-5ff819ca5b38", "value": "196608:qp4+qklD1hnmVXR0niu+JMKUa/dj7jjxZ0PFHlBDXgZ:qp4BSDzn40iZJ/jXcN7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772386292, "uuid": "bd56e9f5-aebd-4229-b6df-f770e2b26387", "value": 10098176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772386292, "uuid": "99b75db3-af01-41c9-8cd3-28ba16bbcaf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386292, "uuid": "bac8ef01-b15d-41b6-bfbe-932c3056109e", "value": "GoodMeV3.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f84750-150f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772329155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329155, "uuid": "47f87bdf-6ac1-48a4-aece-4c22a03c8973", "comment": "Malware payload", "value": "70a9d21a741f0949cdfd063fe585137a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329155, "uuid": "1c8ba2bf-3b49-4c4a-bc60-702f377390e7", "comment": "Malware payload", "value": "083d3d3086bf3fe9f8ed5c193811428d09ebdbbc4cb5cfa1bdd1e333a5377635", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329155, "uuid": "0192823a-b57e-450e-acce-8e2565f9e973", "comment": "Malware payload", "value": "b887a8cd37a78ab3f9ad1f42f8cefbaea8be4e35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329155, "uuid": "cb8d62f0-ea01-4b98-bd9e-0a1adc2d8dba", "comment": "Malware payload", "value": "8e187043423fca4cc9901b78c636b1c808b9ce00b5f6323fc1ba648bccbece6fcffde2b1a8d75f8377088f07ac17b695", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329155, "uuid": "e4ed76b8-d939-42bb-85f5-e8eb1d74c6bf", "value": "T146924BB906496C79FBC0CE799F3C7F0CAEE582C42128E39DBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329155, "uuid": "50c00aa1-9f42-46b4-a1a8-a2c6860b0988", "value": "384:bincuxOLnVYMSZzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:bpuQL+ZzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772329155, "uuid": "44bca16c-96b3-4012-a4ca-701473658868", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772329155, "uuid": "73c176c9-3167-4f08-a2a7-48c0ea83b6d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329155, "uuid": "fec79fbf-0c63-41a8-82d4-4b424562acee", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb21512-15a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772394666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394666, "uuid": "32a17579-7941-4234-9836-fb260456a9a4", "comment": "Malware payload (Mirai)", "value": "a2368fe207afdbc3dca8a2546eeea8da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394666, "uuid": "832555c2-ef90-492d-a4ce-9629c822628e", "comment": "Malware payload (Mirai)", "value": "089028a57512eb953d7aabc9de93c6d1e1fcc17d76a371622ac02329298e0b8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394666, "uuid": "cbf8178d-9771-4c72-99ef-db5a69654cd8", "comment": "Malware payload (Mirai)", "value": "0457884f300589240e0f705cb43d26fec6ec954d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394666, "uuid": "114ede25-b81d-420e-8528-008a8e40de22", "comment": "Malware payload (Mirai)", "value": "2d950fdfdaa57e68cdc4ed633bf02b6af05bd665fa00ca4e65d0f0d2765c07f6201861fcec1ee9f5b6066a6a05324a9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394666, "uuid": "a24e0a02-0bf3-4542-b9a5-b0692046f12d", "value": "T1EBA36D86F753E1F0DD4A06B0105FB73D8674DE225024DE5AEB94BEB2EC32A02A65771C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394666, "uuid": "9764cd94-07d7-449e-8720-545c55bc3261", "value": "1536:rBdBuOHcu8LbNaTuAaSbNKpKkFkxyvDUt7GT5HchuP3YUK31IyiiGcr:DwO8u8LU6+bNKptkzo5OaESyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772394666, "uuid": "141db991-9d95-4b46-bd8a-ec056b1c6eb0", "value": 100664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772394666, "uuid": "99daf0a3-65d7-47cc-b6ef-de6916733808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394666, "uuid": "48d38c4a-e134-4d60-9519-647dd498b985", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769219c6-1569-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772367813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367813, "uuid": "c34e3883-bbab-4b50-9fb6-c36b983f00ca", "comment": "Malware payload (Smoke Loader)", "value": "904eab8bf451cc8e13eb60c952e538f8", "object_relation": "md5", "Tag": [ { "name": "217-156-122-57", "colour": "#7EC429", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7567", "colour": "#8008E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367813, "uuid": "2085b682-6d03-4fff-b73a-299746583cfc", "comment": "Malware payload (Smoke Loader)", "value": "08fb8bfb5fa63abdc054e16eed945c6b0636744ff34b2c3e1a2d8e80e71cd116", "object_relation": "sha256", "Tag": [ { "name": "217-156-122-57", "colour": "#7EC429", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7567", "colour": "#8008E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367813, "uuid": "35c2b42f-56bf-47a4-937a-8367138c4f35", "comment": "Malware payload (Smoke Loader)", "value": "d92b2f5713dc92862d01389d79f0b3cc20592f22", "object_relation": "sha1", "Tag": [ { "name": "217-156-122-57", "colour": "#7EC429", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7567", "colour": "#8008E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367813, "uuid": "41d16ad4-95ed-4ee7-b566-9455c6cc59a7", "comment": "Malware payload (Smoke Loader)", "value": "94dca0fe79a2f510a13a0d4a523143a32c95bd2a04ba5ff93e3058fe7e3cf85cc48924f0d32600d5999fe499b1183d8c", "object_relation": "sha3-384", "Tag": [ { "name": "217-156-122-57", "colour": "#7EC429", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-7567", "colour": "#8008E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367813, "uuid": "bbffd4ec-b8b6-43b6-a7ba-08508b71278e", "value": "T191E63358D8DC858F41CE7D0AEB976F366484870C6B1BF960AB44CC3D93D162BDEA90C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367813, "uuid": "ff2e2941-7c00-4a5d-9572-911b86f928c8", "value": "393216:m3ow7g1YzJyPaOX7vLfdmSfgz+cj9wVBY:X7MyPbzLf0cPfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367813, "uuid": "5f9c0f28-db39-4549-8ead-e8440985f989", "value": 14634003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367813, "uuid": "ecaa645c-e3e8-46c3-9eb7-46f9b35f1fec", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367813, "uuid": "2dc413d6-12f0-456d-913d-d0e4df2360a3", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7449d64a-150f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772329154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329154, "uuid": "e3aec47c-7114-44fb-b8f6-fab24da50977", "comment": "Malware payload (Mirai)", "value": "3f7305bdd05f4303e8a6e44de37653e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329154, "uuid": "6f4a765b-30fc-4398-bfac-0285aea54f42", "comment": "Malware payload (Mirai)", "value": "0982b6d17587ff81a61749958122ee464d687dfe3a87b2c933a1f3df4159be57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329154, "uuid": "c74e1fba-dc64-4993-916a-8ee0f51c9da8", "comment": "Malware payload (Mirai)", "value": "863fdf45cd7a5b50eb67edecbcd106738f1900c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329154, "uuid": "ee4e68bc-23b9-4c76-b05c-961c4853a8bc", "comment": "Malware payload (Mirai)", "value": "74dd244cda21d736dcccf56c6dc8ec4cf0a5916c9d58887bbc05e0b2e4a99dc852009bc5c61c9ee6d7c8df66efc34093", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329154, "uuid": "b3188155-ff0e-4122-b48a-43a9aa52b09b", "value": "T177D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329154, "uuid": "36ea1b1c-4dcb-4ba7-8605-c6a166002901", "value": "3072:FCldeCsOs9kzj2vV4XcZgqgCBV30Y+FelsjXjFQ:gPeCK9kzivVYHCzlmjzFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772329154, "uuid": "9e6fe11a-e2dc-4d09-b281-55f7f5bd7f86", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772329154, "uuid": "90493617-f0fe-4976-8681-c0fe257fb6d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329154, "uuid": "1ecdc289-1bc9-4d42-a869-fe277892423b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f21999-15af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772397747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397747, "uuid": "3ae1c847-771f-4362-bfc8-26138290bbc1", "comment": "Malware payload", "value": "b19b2291e6098392e4cd0c279e05fb4a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397747, "uuid": "8eabcedf-4864-4780-a940-ab6739c3b2d9", "comment": "Malware payload", "value": "0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397747, "uuid": "d6048010-47c8-4350-9df4-0f852c9c5ed5", "comment": "Malware payload", "value": "905561f410339e02174a0abadf5109d80efbdd72", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397747, "uuid": "f9dde7fe-94ba-4135-a377-e895d0da46b6", "comment": "Malware payload", "value": "09bd6b2136af9f179abe69fa672d9f7992c95e2cb9f7eb344d58ff83e3e24d989c617275e8312c4e30cbb2989618ec02", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397747, "uuid": "847d7c21-dab6-404d-8ed8-d36f9de9351a", "value": "T158924CB512896C79FBD1CE39AF3C6F4DADE8C2C42124A3ACBA4F39205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397747, "uuid": "3e9892e6-3391-4bef-93cc-9adaa7f8c643", "value": "384:RVdcuQpWx+BL0SWL0guzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:Rv8i+BL0SI0NzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772397747, "uuid": "1638e8e4-72a0-48e0-8c71-dd950cbed27f", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772397747, "uuid": "7e31aa21-eaf7-412b-b1f5-fd9cab917478", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397747, "uuid": "77af65d4-f2f0-482c-93f5-262bd2d6ed9a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe633e5f-157a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772375342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375342, "uuid": "b3ba8a86-8ae2-4209-8309-7089735505ae", "comment": "Malware payload (Vidar)", "value": "e763a7ab1bec3eb2e0fcd7ba666707c5", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375342, "uuid": "cfa96e05-80a2-4bdb-a9ae-1f0dca79d077", "comment": "Malware payload (Vidar)", "value": "0d9630a8bc113bb56f78967fe57b95c4e7488baa0544e6e514aa2b292ccf88d8", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375342, "uuid": "2efc98b2-8c7f-4e0b-b342-828a591ce48a", "comment": "Malware payload (Vidar)", "value": "64522a4dfac576ba27d0cc9c0b3617313111d882", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375342, "uuid": "623bba77-0b0a-4ea7-8cd6-6bf9f486ddc1", "comment": "Malware payload (Vidar)", "value": "8af9de82babddc78daf72d5e209ac3ef9388cc92743acfbdb107f820679c6cda9f93b58314ab5dfcda548b9c9c2ba5d0", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375342, "uuid": "efe4a18c-05d2-44f5-b13a-50ce5cde9964", "value": "T1FCB57B5B7DD51CE6C46EA7B28DBA21813734BC490B3233D31E54BA782E726D09D3A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375342, "uuid": "7cd16f58-6fcb-4ae8-930b-b9b390d37c59", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375342, "uuid": "f572285f-800e-47aa-99fe-42c523210f03", "value": "49152:fJgL+Ro3Cw5lcVcwFtBJNerguEEJKuZ/UUzy+:fJNOF87uEsKwFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772375342, "uuid": "568ed8c4-38f7-4b3d-a740-5829fd5e862e", "value": 2401792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772375342, "uuid": "796f471a-81e0-4738-8e0c-c2e8f0c14094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375342, "uuid": "fe73264a-24fd-4d12-94cd-9e9ab1b82a4e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa746a35-154b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772355149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355149, "uuid": "0bf71dfa-9247-45e0-abed-79b1b87d7885", "comment": "Malware payload", "value": "20349faff3732a4f2a800905d357a9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355149, "uuid": "e396d6bd-d04f-4437-9dc5-c792c83c5eef", "comment": "Malware payload", "value": "0dcdb0d959c7881b06940fb6984a5375dd76d42a58ebc3f42fd06bff9413c368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355149, "uuid": "2a94158e-5eb5-4ccf-b0e6-e8cd517fa083", "comment": "Malware payload", "value": "6a2dafdbfd9a34687c1cd239d81b00fcf29ef5c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355149, "uuid": "6e2b2d71-6d6e-4750-b798-11fb40794801", "comment": "Malware payload", "value": "bafaddc339b24479f141f16f5ae944878941e102ca7bfb0aa47699308f966587cdaa28f351f3eb971daba30de5548ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355149, "uuid": "e77979c8-9702-4f25-b33b-339a108e5d82", "value": "T17956E082616C84F3EEBE5EF16F01EECFA801552315B0F4462EABE8CCBD17B186635156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355149, "uuid": "05545ccb-3032-439d-85d5-e06ab8054314", "value": "f1f576d3ef3824aade0a784c627eef2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355149, "uuid": "e1e213f4-9180-4138-a314-5588f41e3d0f", "value": "98304:Owxq+bmXgvQijdRoPW6zvdPfcMhPQhBDCKPk6JA:Owx7G0QS4OyZfcI0wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772355149, "uuid": "d62f0ded-de38-417a-9601-5ef21acf7f93", "value": 6228480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772355149, "uuid": "1344574f-1d85-4f7b-9bb8-1fb16a99556c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355149, "uuid": "e1d4d3db-51c8-493c-b215-ba3e479fe8b7", "value": "SecuriteInfo.com.Win32.MalwareX-gen.78941563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbea024-157c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376198, "uuid": "4ffca258-c5f4-49a5-8cc6-74d7448de9d3", "comment": "Malware payload (Mirai)", "value": "024bb37ae99f1ff1e90ed7319b7e2ea8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376198, "uuid": "6ab5ad3c-969f-4db6-af52-dbd4d28a065d", "comment": "Malware payload (Mirai)", "value": "11b569ca04e01c1da7072841712a399dbb15bc67b1d0f6cb6ff037de5b62a23f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376198, "uuid": "06c45a76-56d5-4a8c-8985-585f63421dfc", "comment": "Malware payload (Mirai)", "value": "bde6265adb0edea556d814f74bd3dad41641052d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376198, "uuid": "140ce641-b20b-4ec2-bd28-c9238b2180a2", "comment": "Malware payload (Mirai)", "value": "17336d680b4c2b8296c0645c96beebe1a89003742343a5cade892dc6db788bf9dd2cc0aa5153ed8951d09de263f07cdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376198, "uuid": "e8bb7197-345d-464e-b142-b6286d14b670", "value": "T19FD32B81BA43CAF7D40304F001BB663E8F31FC2A4837D595EB69BEA5DA135C1A61636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376198, "uuid": "47e9215f-763b-4e96-b9fe-88df46e31fbb", "value": "1536:XQizGOKZMEuwmZaUkoIJ3nRi7xUX0GrWVR3WNy4PJ+GpPCI:X9zGOKZMpwmnDIJX47xUX00ICUGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376198, "uuid": "0f7d73a3-b0cf-4536-9cbb-a0a5fa0e307b", "value": 132584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376198, "uuid": "236b4f3f-310e-4289-a93d-39109e613bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376198, "uuid": "45c01837-6191-4316-a016-33e4fd1c5ea5", "value": "nx686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e41edf7-15c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772406346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772406346, "uuid": "4243a28c-63c3-4d99-b293-4ddfd6cf6449", "comment": "Malware payload (Mirai)", "value": "d3dc423c560943fd99b3b3cde8f3f965", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772406346, "uuid": "337b2e76-1fc1-4a38-aa6c-b06bbf8b486a", "comment": "Malware payload (Mirai)", "value": "13e133c7f40ec580228b33f38677a3aa836e54ffbdcf21a26d513a173b457389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772406346, "uuid": "1412786b-8565-4d6f-905d-5ebe20d6b0a6", "comment": "Malware payload (Mirai)", "value": "8c67a6cea3154c7fc9fd1a929eb8fab801aa705d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772406346, "uuid": "3bc5891a-47b4-4bd0-83fd-722c8696cf94", "comment": "Malware payload (Mirai)", "value": "8689401f81e15fa8fd3a517ba6e0df781059b646ee67ea34490c5894422734081a1d305d5909415b6f1e9312b14efe1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772406346, "uuid": "324640f7-6952-4f4d-8ea3-fe6b3ded3297", "value": "T16936D818ADC43BEBC01C5B7494EEC95622B45D144AF14A2666A4FBE9BC77334BF0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772406346, "uuid": "712045eb-0db3-4b34-884f-d57c1604de76", "value": "49152:J484+e6OdMrIoH2Lgc+unNt+FZw/NMq5E76M:+kc+HiWgEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772406346, "uuid": "489fd19c-d1e8-4142-a44d-888299d845e4", "value": 5177559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772406346, "uuid": "53ff2de9-ea63-44b2-a072-58f0fc0e9744", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772406346, "uuid": "d69b3af4-7933-4287-8d7c-7280e1a897f5", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826a5251-15a5-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772393602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393602, "uuid": "7b12e5af-d378-440d-bd7f-bd45d0e5429f", "comment": "Malware payload (SalatStealer)", "value": "0cf5a1a6673acf707637bc7087529e6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393602, "uuid": "bf4c903f-34d1-4827-a635-909477ee5f3e", "comment": "Malware payload (SalatStealer)", "value": "1509aca8776d295cb4852db6397e659eb5fb1619627cf98c9ccda793aa605ae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393602, "uuid": "25475cfd-7aed-400b-9f56-5d590dd2181a", "comment": "Malware payload (SalatStealer)", "value": "84b7556b4d1623ad425c1f48e31b8afdd4da3560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393602, "uuid": "454e13f2-2c26-4464-b822-441a7b001575", "comment": "Malware payload (SalatStealer)", "value": "e7c2fd1385afd6bd52ae9b6c680ea583a593a5e479cd99be4da697b58793b57c9f2db6d05aedf72a6c3ddee53e9360c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393602, "uuid": "62fb1561-4879-4807-86a7-bcae3860088e", "value": "T150C65B51FA8B54F5E9031831416BB23F23315E048B68DBEBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393602, "uuid": "6ddc7fca-ca23-44c1-87f6-1a55df1ec9b3", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393602, "uuid": "8f430bb3-fdee-4f1e-b1a8-a6b6749ecb76", "value": "49152:FtxktkFkPWLDl01NLE1UcQpYjS6x167Du0jKKDDcv0YJNo+CeOr0HPQoqJdW9wPe:HCtkFllZflv0R+C3eqviVpmVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772393602, "uuid": "a29a297d-0a42-430a-a6cb-20910be69966", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772393602, "uuid": "6539d38e-b26c-4ddf-8311-8632e5186fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393602, "uuid": "d2c68aab-6121-4670-b0bc-0f05ea6dd3fa", "value": "Velocity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30435a65-1582-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772378432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772378432, "uuid": "57fb2dcc-674f-43cc-8ada-2aa5d67c77ed", "comment": "Malware payload", "value": "e0d1da6ce4e73c4cc5a202cb15d69414", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772378432, "uuid": "74ac5cfe-3049-4823-bcba-511709c004b7", "comment": "Malware payload", "value": "153ef71c0ccc58d47412a8ec7519747de3ee141ab73e4284dc508c1e88247df7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772378432, "uuid": "11784736-72a2-4abd-a60d-7c4852d56594", "comment": "Malware payload", "value": "57cb8f472dad864d228d1c606b9abd3c11a6c010", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772378432, "uuid": "7e22df05-df8e-4387-917b-b7c4c59fd0d3", "comment": "Malware payload", "value": "a4cac6acdeed10d1e37f49916cd9797d20aadc4a97cf3ae3e6a54c3e871bca675605be9b807103da3f250ede0e78ac59", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772378432, "uuid": "56e1b2b5-427b-44aa-80a4-95f8fbba119e", "value": "T1C5D42BBDAC60E376F60CD0BAE286D3538F2139011236AA9319BD97241245473DB677FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772378432, "uuid": "1f03dc03-b301-4ec5-b769-e7c3b28534ba", "value": "32235cfbe2c6b05c5b53af4a209e0eaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772378432, "uuid": "4a0536b5-1011-40d4-9cd7-4933686095a2", "value": "12288:MPyurkSSu5EkPm8b7k4ao/CXjp4JgtU8F6CmSYw2g:MPTrk5u5EkPb7jgjp4JS36UYw2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772378432, "uuid": "84a5967a-04d4-492f-b957-c914187e7c47", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772378432, "uuid": "5838a2b8-6753-4f76-b586-9a9ba698692a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772378432, "uuid": "b289181b-5f2d-4ef6-b6fa-498c3c82e58e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1e71bd-1568-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772367532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367532, "uuid": "8b017454-9f64-4c82-91f4-33bc99ba96b4", "comment": "Malware payload (ACRStealer)", "value": "07ef7e83a9acd26e93262616ab5a56c6", "object_relation": "md5", "Tag": [ { "name": "146-103-104-188", "colour": "#6EEE8E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367532, "uuid": "94369ff5-1a8a-4c5c-aa10-fcb6d498fa72", "comment": "Malware payload (ACRStealer)", "value": "15b9f7098de5762f0a86cb8adfd954f37c2454da562b113b58d198bdb5800f3b", "object_relation": "sha256", "Tag": [ { "name": "146-103-104-188", "colour": "#6EEE8E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367532, "uuid": "b75a7c61-9498-45f6-86d0-5a4ca0d9136e", "comment": "Malware payload (ACRStealer)", "value": "ebb8b4e52d40bd7587fd29cdbce5983b1b823bb8", "object_relation": "sha1", "Tag": [ { "name": "146-103-104-188", "colour": "#6EEE8E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367532, "uuid": "1f39c4b6-652e-457b-b2ee-7e510f4bf46f", "comment": "Malware payload (ACRStealer)", "value": "22bfbd7ee8aac497d091743143b22db9a2137df065ffdeed4b2ddf22f87f78611145e4268701ef146761dd73c47ffd7d", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-104-188", "colour": "#6EEE8E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367532, "uuid": "c464fe5a-7ad7-4a04-99eb-f10b8b2f641c", "value": "T10A1733F3E319087AE05FB33914694225FC62B51CC178360A439269F91CE3BD993E6B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367532, "uuid": "98c3776a-6e58-4648-862b-c376c2dc4fe0", "value": "393216:sGuTIY2btFg5A04BxKwPwxKlQ4hTuLFe5VJiciw0CQYevECX0qT10p:pY2ZFg5wBxKwHlrgLAvYQQvMW0cGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367532, "uuid": "a0120ac1-d957-42b2-853e-13bc85b462dc", "value": 18816252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367532, "uuid": "65a846c7-6b9a-4d86-a54f-ec7eedef86eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367532, "uuid": "38973e1c-05c1-49c3-b464-565e87b9389f", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38cb648-156c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772369230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369230, "uuid": "ed231b2c-c194-4e42-9d47-54f3a4e70594", "comment": "Malware payload (Stealc)", "value": "b1d9bd792f1d02c14e787f8fd3e9d6f1", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nonobody123-com", "colour": "#A21140", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369230, "uuid": "36d13536-c76a-4236-8de6-c9f7adaf1dc9", "comment": "Malware payload (Stealc)", "value": "15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nonobody123-com", "colour": "#A21140", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369230, "uuid": "b373f638-085e-4395-bb4f-35fecfc56977", "comment": "Malware payload (Stealc)", "value": "b86ded17dcfb834f4e349251883b1aef9b74ac7e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nonobody123-com", "colour": "#A21140", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369230, "uuid": "49da234a-ad2b-4273-8036-815c9c311feb", "comment": "Malware payload (Stealc)", "value": "43537ff60ac900a602e8687e958a7db27224a4f59cdfb2566cab0fbf636a85a7d57004ad299396b694e97237336a849d", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nonobody123-com", "colour": "#A21140", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369230, "uuid": "e2f2c7c9-1f28-41b3-af86-646abcbaa44f", "value": "T1F3C57C0B7DE51CE5C86E9376DCBA11827B31BC490B3223D31A6579782E736D09D7AB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369230, "uuid": "3191ac85-952e-4a95-a612-aeb2e99b9be4", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369230, "uuid": "d8fcd546-a541-401d-8fe7-114285341e96", "value": "49152:V772LjTr6vcDarzmHUdTT6/j7TvDlTyBUP:V7ofMXmS3OBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369230, "uuid": "0dc3bf24-a7f8-4ae9-99f2-60f851646a69", "value": 2538496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369230, "uuid": "f000fd3d-5bd6-4377-97e0-3397639fff59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369230, "uuid": "197abbbe-9a34-4446-9fbe-dbcb9b6041e7", "value": "Licence_Version_Loader_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da53e420-15a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772394179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394179, "uuid": "88e32484-7f54-44ff-b377-ae79b41334d5", "comment": "Malware payload (Mirai)", "value": "cdba4d8817f7e72a5e214756928d7dcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394179, "uuid": "3407d275-5d02-41a3-aeea-f73c57cbd64b", "comment": "Malware payload (Mirai)", "value": "16e9a49a24b133bec1495bc6ab5b2314e78f259fe2b357f0306daa68ac10c67e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394179, "uuid": "96b7a0cb-f702-4ae3-8baf-d0536f341421", "comment": "Malware payload (Mirai)", "value": "ee676fdb31f0c358444f65f1fa0711a09eacff9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394179, "uuid": "9ba1f9e5-336f-40ed-bbdb-c57fe98d649b", "comment": "Malware payload (Mirai)", "value": "90efc15e226c83d12a2d168045decc492bc9de85448106ca384d8a598bc447ec41fa7ecf61eedb3f1207160b36d14293", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394179, "uuid": "f0200279-2dac-4a8a-9212-64ba05952c4c", "value": "T15BD37CB2C8656F68D265D0B0F031CF791BA3A91581871FBE59BBC6B54083D8CFA057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394179, "uuid": "dfcc6968-34c5-4c98-8da5-1baba9dc8c9d", "value": "1536:YF4nOOmeIOT31izpPNKHySHCJ3KORg9p4Je4zv94rbWTel7qr34z5nR:74Oj1iKHySHU6OjJe4zV+bWKle7sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772394179, "uuid": "16d16cad-08b8-4576-8b27-4ad3aad026d8", "value": 142112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772394179, "uuid": "f7006e5a-fe1d-414e-800e-3302210cad38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394179, "uuid": "76e2664b-f770-4197-bf9b-82bde01fbae1", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bed06a-1551-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357334, "uuid": "400269ec-2339-4f72-8a26-8522b09836ed", "comment": "Malware payload", "value": "d623bb04db43c0b9b2d695f7cf126f31", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357334, "uuid": "a1dada39-f428-49e8-85cd-6dccade5b8cf", "comment": "Malware payload", "value": "17018352204b04c4ac124d854badcffe1eed7b6bd0b558d05cc0586b852e1d66", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357334, "uuid": "c733f53d-40fe-44e8-a60e-dd02270476ba", "comment": "Malware payload", "value": "265a95b7ce1555302f64c6958ad5c30d0619f4ee", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357334, "uuid": "2ba2dcb6-bd99-4fff-a16f-2fda47499c5d", "comment": "Malware payload", "value": "55f50924d2a87dd85488c333304b2446283f8e571664b95714fe46d14d3725c82e62490b2ff1ee15f6fc000ddee6cb5c", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357334, "uuid": "6355f029-11a2-4736-9e53-3e584c174446", "value": "T109F062558999CAD26DAD5065B2630E61086F5E172A0B2B02724845D2C2EBE1028927B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357334, "uuid": "4f3341dd-41fb-4040-ab9c-0eb1b502420e", "value": "12:oEOrn6MRxBAL4QQFSWPFYtJCG9gkjD37xB3R8hV4t+GiorIBe16:ZOrfM4Q7WcgGSw7qzb+IoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357334, "uuid": "bf0ff87c-4412-4699-962d-35d4c2ccdd96", "value": 639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357334, "uuid": "22b3bc81-0a5c-4a6b-a56a-1f7d08c6a793", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357334, "uuid": "b8561ac4-9eb0-4dd2-851d-398067dbb751", "value": "17018352204b04c4ac124d854badcffe1eed7b6bd0b558d05cc0586b852e1d66.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8944ebf0-1565-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772366126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366126, "uuid": "8ef63f05-2dad-4bfd-825f-13a1c55c0e52", "comment": "Malware payload (NetSupport)", "value": "806e6c7153979b0fc387a24a3d18728b", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366126, "uuid": "a7129058-9449-4093-8f85-bde947f12aa6", "comment": "Malware payload (NetSupport)", "value": "172ac955536947c635b917e3d0ab5c06df2c354a6bcd210c07ccaacdae03c108", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366126, "uuid": "1ddb79cd-7aa2-4409-a8f4-23a7237cdc7c", "comment": "Malware payload (NetSupport)", "value": "3410d2d8dd25d95e6d88edfc9a28c202db5f83f4", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366126, "uuid": "ec98a19b-581d-4f67-824c-66e1b2939df7", "comment": "Malware payload (NetSupport)", "value": "64a121314dd161e10a6a521c006a8e5d53ff0c8b78c208318d3b4216d37e66c98e2a7bda307c61093d9d51f7b6078204", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366126, "uuid": "5a3238f8-dbb3-4cbb-ae31-3d0cba9722a5", "value": "T1FC434B2075B499D11152A77AC4B24F409F26318E7DA6FCF076C842834EB9E373DDA9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366126, "uuid": "c3ffe2a1-fdc7-4dcf-9b80-7e98b4017224", "value": "1536:+3dr+xx9OffwWe/bEZyM5t3Swdpif4gf+1tM6MgZeftf7TC6Eizhffry0MfTozMV:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366126, "uuid": "3aba40f7-02ed-4554-8793-a7a9104c9be3", "value": 57823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366126, "uuid": "e3e09b11-8804-4d5b-923c-38bf32a8ccb6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366126, "uuid": "ed402a1f-cfed-45da-9971-99f418bdd406", "value": "channeln3.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ab594b-156e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772370086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370086, "uuid": "f57747d3-e584-4d2d-aabe-3195c77f4835", "comment": "Malware payload (AsyncRAT)", "value": "6654e57e817f72196113b3b80b24dd5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370086, "uuid": "6dda0c7f-b8a0-404f-b1bb-b5ca46d17413", "comment": "Malware payload (AsyncRAT)", "value": "1886503dec92d441555290aa8c365053c65d80bc3678bd74e4e13223cfd80196", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370086, "uuid": "98d0d2c2-e08e-4fc2-ace4-d2deb1218456", "comment": "Malware payload (AsyncRAT)", "value": "ddd47b07f6922fdcfc08c1469926140d39c0e35f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370086, "uuid": "04c1d555-5793-4875-a811-a97cec165a1b", "comment": "Malware payload (AsyncRAT)", "value": "24cdca3108bb6857e2355b2903861ff487edb50e60cb94a18869b2e59a4c6a09dddd11334f97b512a524aeba4acfa63c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370086, "uuid": "01c13200-4610-4d8a-94ea-110250ce7ce8", "value": "T191F24A0573E58665E1FD1B7D5C3686044372FA474D62DBAE2EC450AE2A237C8CF24BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370086, "uuid": "c1117629-a235-4771-a6e4-53f8f3f0d99c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370086, "uuid": "759df08f-8479-4169-9984-06e6ec11f7da", "value": "384:WMTpS1B1Y1n4woSSh0lE1bdcWOe7X093bayseHQxnC7O+WmlIuufGfrfCmHWWBt8:WipSLi1n4wAhj1hVYRbJwB+WW3kQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370086, "uuid": "77d24e4e-161c-4ea9-ba16-ae8f3a0e38b8", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370086, "uuid": "5531b6e6-b613-4731-97ed-775dc147d989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370086, "uuid": "2eb4e5e0-ae57-4b21-a70d-2890be4ed08f", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4fd591-1552-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357810, "uuid": "3641c787-783c-4faf-bf82-513a10f8c5e6", "comment": "Malware payload (AsyncRAT)", "value": "740291019c6a844b4203d870dc26d13f", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357810, "uuid": "b849c3f4-0e00-4ca0-b7bb-e7f3e1ca1af8", "comment": "Malware payload (AsyncRAT)", "value": "18c781259384f8c799eb03739f7dee9f312c2d9af8f39ea9eda302a43d78af3d", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357810, "uuid": "78837342-f619-4486-a9e7-feb03ff341ac", "comment": "Malware payload (AsyncRAT)", "value": "c315b4ec58a3aeeb7a3c4cf75f6d5ffa4801ae99", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357810, "uuid": "c017132e-2fd2-42a6-9baf-20633ea721e4", "comment": "Malware payload (AsyncRAT)", "value": "d71b65f63f4df417f47e1d57a622d4f86b6b12442848320d1657c15d746f6bb2fa4080d61428aab1d6690aaee437e7ae", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357810, "uuid": "7b248e45-3d1c-4dd0-9ed1-6096050991e4", "value": "T1E9568C14A3E901B4E577EB78C6258333C6B1BD959735810F0669FA4A2F73A604F2FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357810, "uuid": "38074ff3-9989-4ec0-bfc9-73ef52cb3654", "value": "22e78a00070f9fd81c1508aa25033259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357810, "uuid": "4e7376fc-cd12-4f95-a599-40901b8d0e92", "value": "49152:qfSka7VuYZ1pL0XIrVHVuFrwNth4TQt+E7w9Ju8k7L6VCnqIdnDpmViNU9cJKyft:FjfrV9th4TQ9ELZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357810, "uuid": "1841287d-f4a0-4783-a3be-baffbff990ab", "value": 6084608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357810, "uuid": "952baf7a-db42-42d3-a0eb-9e82556d4923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357810, "uuid": "f654e083-652c-4540-9e93-f26cfea3c7ec", "value": "MSVCP140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996e8d00-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772385480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385480, "uuid": "309f84ae-2c05-4181-b310-f9b063f1a79f", "comment": "Malware payload (Mirai)", "value": "277e8c70ca0b00afb0d422fe0b69f9b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385480, "uuid": "0ddcb0d8-b71d-4377-900d-959d99022235", "comment": "Malware payload (Mirai)", "value": "1b20d288e9a1cca16f12a7ae0f4ff297d7ed3ff2112816bb91356154f5010a34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385480, "uuid": "1032adfd-4818-4e4c-bfbc-a54b94b302eb", "comment": "Malware payload (Mirai)", "value": "eb1fe496ac23d13f67f4ae1a1c3bb8f68f9bc7a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385480, "uuid": "c343ea97-3f76-4340-9931-1e2aa068812e", "comment": "Malware payload (Mirai)", "value": "4a0b404696b4f4f10f479642ea91e5451cafb796f396ecc4b499db737770c7a53b9df401c27fb0681892e565d66fe36b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385480, "uuid": "1d41a849-3fdf-4bd7-8c97-43d866bb952c", "value": "T1CB14951E6E228F7DF368873047B74A35AB6933D627E1D644E1ACC1105F2429E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385480, "uuid": "8a3193e2-7365-4b10-8c38-259781900c90", "value": "3072:AOH4DSTLTlrEZUFQNeHYApKuOLkaSO2TH7oZ+0:AOH4D6LTlrWUFzJpik22TboE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385480, "uuid": "7a37b069-ab47-46d4-b292-75f4460c9b2a", "value": 208088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385480, "uuid": "554846f2-c3dc-4a40-95d2-26db89f2e438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385480, "uuid": "9e9c1b5c-0af2-4d3a-842b-f507f0395b4c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba53e0f9-1576-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772373510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373510, "uuid": "b7003b02-6fbc-4c6a-bf54-7576ec626adf", "comment": "Malware payload (AmateraStealer)", "value": "d9fd2030f61cd3f2f8ba3f76ee1ad9a3", "object_relation": "md5", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373510, "uuid": "52667d16-e260-4f08-b6a9-e2c390f7f239", "comment": "Malware payload (AmateraStealer)", "value": "1bbae6f0ed00957fd51f4bdd7c4b007e5bd3c86790c324e8d97fb71afd38170d", "object_relation": "sha256", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373510, "uuid": "f819a766-7514-4f7a-a65b-363606440717", "comment": "Malware payload (AmateraStealer)", "value": "dd889f9a80023ae9c071b6a95edee4cec80cd34a", "object_relation": "sha1", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373510, "uuid": "39d46412-c7a2-4854-a60e-126f03fb6b8d", "comment": "Malware payload (AmateraStealer)", "value": "401157a66bd282caa47388f92d1d827ebc688bffe53832ec1a8d4468c879f986c691d839abbb5131e19d0b6c275d75a5", "object_relation": "sha3-384", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373510, "uuid": "9fa3505a-b97b-455a-a76e-f8fc7bdefeaf", "value": "T15C333B5CF1D992A02047A57BC6307DC19E24B12FD5677CE87EF8428058F8E2A3F9E592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373510, "uuid": "28dfd350-42ed-4439-92e6-0ed2579edb5b", "value": "1536:+X0X9ztiF0LY0e0uZr5o97NR9UBEUpchAA1rGzRwR7MK56b0Q0gpGM2l0UN0vhb5:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772373510, "uuid": "93f8b291-93eb-4706-9691-0e623eead89c", "value": 52773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772373510, "uuid": "123b0545-f1d2-43c9-9f7d-c69bdccbc93c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373510, "uuid": "31e88de0-5949-4050-9ef7-22c4b6e02f88", "value": "blind.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592aec10-1516-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772332115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332115, "uuid": "4688cf97-4bd8-4d25-bf48-3cb291009f7b", "comment": "Malware payload (Mirai)", "value": "832667abbc9c892fa39ded61eaa6fbe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332115, "uuid": "b9fa67ab-1c51-4a76-91c3-3519a2cc1210", "comment": "Malware payload (Mirai)", "value": "1c7fb667a9d2598c97df3c24adf5c78589be6748532397ec1383e2ede0ed1763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332115, "uuid": "1831d0c6-fb64-4dc4-ad82-d75e7600111c", "comment": "Malware payload (Mirai)", "value": "dd1083c99c9ccab1b3ba989710b5b3e92a83d5a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332115, "uuid": "a4363d98-e513-41fa-b4b0-15164f561362", "comment": "Malware payload (Mirai)", "value": "37e9b24331511dfa3e11dcb3919b35e71c6233ffb2d0cdc6ab3b67eb6d229333b7a00a4b14ea56db6af99c313de0a878", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332115, "uuid": "3ef1ca84-a8f3-40d1-8297-e97c2f760116", "value": "T102044B46FB814B13C4D62775BA9F42453323DB6493EB33069928ABF43F8376E4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332115, "uuid": "54e08ef7-217f-4370-9048-2ee381048384", "value": "3072:/TtPloRBcTO/Ca6GMVea8+H0tIIQTBPCaqVZBL/K92S:rXovj/Ca6GMVeT+sIbTBPDq9L/K4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772332115, "uuid": "58661848-2045-4746-b8a0-9d6a618d1002", "value": 179653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772332115, "uuid": "a78c1bc2-8138-42ad-8ec6-7142754bc2ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332115, "uuid": "3137510c-9e40-4e2b-bdee-e0c135b2aff4", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dd16fd-150e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772328647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328647, "uuid": "5ba1a737-0212-4235-adf6-75a4e5d18f77", "comment": "Malware payload (Mirai)", "value": "94d9db622fdecb6ad1540be009cedd81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328647, "uuid": "04a0da72-588c-4e7c-bf6d-d04293b420fd", "comment": "Malware payload (Mirai)", "value": "1d6309fd04e4395a2858c26b9241cd3a9bb83eb0e6baaa44ef0abe7864fb7e3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328647, "uuid": "4e8b5886-0675-4576-bac5-b47b69c5d7f5", "comment": "Malware payload (Mirai)", "value": "a422c01f3dcc19d71fac02eb160a22a92d2eefb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328647, "uuid": "8eebe8cb-31a6-4b30-9f7a-50ba8cc76d43", "comment": "Malware payload (Mirai)", "value": "14f8a7329bb8ff24b8ed7c7c41117a95201578b90d98e9b71770b64bc40dd1d2cdc14112ac1bedc772e2580e9a3100ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328647, "uuid": "0dc4a8d0-7e65-44fe-bc56-3762221ff0e6", "value": "T118F23947E683D0F5EC6B1272447BB336C376E1AC1124CA96D7A8E833BD53510A61F2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328647, "uuid": "080a6a03-2968-41c3-add7-10af66b04851", "value": "768:xA4sw7+l5DE6XADlsZT+3Xc7VrDVcmfz76T8K9BISi:xAbE80DSZKnyDVNfv6P9BC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772328647, "uuid": "3f221c84-5a4c-43bb-a32f-fe459a81cdd3", "value": 35056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772328647, "uuid": "244efa0f-c950-4a3c-86b2-c42d2461e078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328647, "uuid": "9e57a604-c796-4c3b-b1a7-0ad424f72058", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff8d770-156e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772369949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369949, "uuid": "a7e2073d-9881-4508-ad3a-d11c88234b54", "comment": "Malware payload (AsyncRAT)", "value": "3734ef75d18577eaf071fe0f9be5b79f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369949, "uuid": "4a8435c7-4177-4b3f-9d9e-de8bbf8029b4", "comment": "Malware payload (AsyncRAT)", "value": "1e0099abcc158b9b677d3f772a533e8e1b8cb1449d29740909bc493d8cd3017c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369949, "uuid": "f4f844d2-e5c3-42d8-b291-23c015a76fad", "comment": "Malware payload (AsyncRAT)", "value": "7bf106371a0e6e57d72000cfb0516f0d02b9243a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369949, "uuid": "91479f18-46be-41a6-8de0-65d5cd2b5eda", "comment": "Malware payload (AsyncRAT)", "value": "3125a4c03bf1884a6e319d906b2bef5ff6065ec48b205a039846b93d70d1b8006b8d4759fa7c8ef85fa3a0259acbd5ff", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369949, "uuid": "8a8b9474-6015-4d82-9a27-f3926a64e6a2", "value": "T15CF23B0573E596A5E1FD1BBD5C3686044372FA478D22D7AE2EC450AE2A237C8CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369949, "uuid": "370c98c9-c555-463b-9644-baa44475be1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369949, "uuid": "82e1d44a-7c28-4a9f-84cc-4fd21d8e9fbb", "value": "384:iMTBWq81lvi1iAhulE1bdcWOe7X093bayseHQxnC7O+WmlIuufGfrfC4aWWnEQ+:iiBWb/vi1BhR1hVYRbJwB+WWw8Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369949, "uuid": "e028e354-e68e-4930-b548-52ed872142da", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369949, "uuid": "9472257e-cdc0-4e76-ac50-7f939abab1c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369949, "uuid": "704fb454-d356-45ef-8740-438cebc1625e", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc47ba7c-1565-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1772366265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366265, "uuid": "f3b29957-7624-4731-9344-474b96df079d", "comment": "Malware payload (EternalRocks)", "value": "9fff92c7f7822f32b3efbad9b4799793", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366265, "uuid": "e9a5b611-5382-455c-846c-7cd06bff6b20", "comment": "Malware payload (EternalRocks)", "value": "1e5dbe753b1b2d61c831e37a6805e93cb568125fd0874203e9d424c5b2a430ee", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366265, "uuid": "ee03fd95-c18a-41e0-bffe-ecd135e93a01", "comment": "Malware payload (EternalRocks)", "value": "a36e59d5ca968a46ff51f2fb975f50fce2155d3d", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366265, "uuid": "46f8d08c-b85d-413f-9a9a-2b09ef086213", "comment": "Malware payload (EternalRocks)", "value": "678479768b7553d1d040a25c34f67caf053e6b944bc3066e75d15e88564af5d3374a4f5b1dd46adbadeb1beaa51112b4", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366265, "uuid": "8eece04c-a20f-417a-bca3-e244f41be7ba", "value": "T1F0433CB171B499F11152EB7AC0B24F48DF25314A5D767CE2B6E802064CF9E233DDA9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366265, "uuid": "62d74556-c759-42c1-b53a-d435acc4d202", "value": "1536:+++Uv++jxyncGg856bVA7Z+JYVB5Q4YeCT+VLifnl+RO5w/ww15Y1+Wxf:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366265, "uuid": "1e4810f4-9d30-40a7-9b05-c3f6c450e667", "value": 59297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366265, "uuid": "eff4d32c-c670-41cd-9f3e-c64b5cbb5589", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366265, "uuid": "b1b4562e-5a3a-441d-bb10-f11e624662d6", "value": "sombr.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6877933a-15aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772395706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395706, "uuid": "ff0b4fc3-2fea-4eae-a9cc-d162e747521e", "comment": "Malware payload (Mirai)", "value": "b8257ca72e1d66980812aa1b70ba1d12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395706, "uuid": "6cf23321-3d22-4dc5-800d-952a2ed8ea03", "comment": "Malware payload (Mirai)", "value": "1e8eb60683d927496835fade6a2166b684f4af8b263aeb2e2b189a7ce54c0a13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395706, "uuid": "cd34240e-b35c-440b-a5ce-600bef24feed", "comment": "Malware payload (Mirai)", "value": "1199cf82e6ee8d9879b27cd05a7ce5b3af7146fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395706, "uuid": "5790555c-981f-4b63-8a66-4d83e634d02b", "comment": "Malware payload (Mirai)", "value": "1dd59876d76126a9e8c4865990ebbec8fc977d9627ff16cd6665c6ffdac0c876737264737edd3945360f829d45a2859d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395706, "uuid": "fce841e6-ff3e-419b-8f9d-3b85032b03fc", "value": "T11D242A45AA408F13C4D727B9FA9F424533339B54D7EB63069928AFB43F8779A4F22601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395706, "uuid": "74cb6d3b-96d5-430a-bb81-bd6f21e5954b", "value": "6144:gMKWHF7LHkj9zayHxedfm1glE/waVvyHoxOM/R4COaq:55pHkj9zaixedfm1gOYQvtxn/JOaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772395706, "uuid": "fa6bce59-4a99-453a-863b-20926d57d4de", "value": 215237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772395706, "uuid": "017afe9e-7264-4c3d-9ca8-61423b0ece66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395706, "uuid": "bfe88b3d-25b7-41d3-9261-7cc4e003c918", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb16c2f-155d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772362669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362669, "uuid": "47480b24-fab7-4989-8047-71eabcf64be5", "comment": "Malware payload", "value": "0dfc783bb49ef2992382cb2f8574f1f1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362669, "uuid": "03f017f8-c867-4a9a-8635-02f63e76dd89", "comment": "Malware payload", "value": "1f4d77a8644408778c03df1a2504888eb585b1a6628c449ca3face600e0d8535", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362669, "uuid": "6cec224e-ce1b-4880-88e8-87a72f16c59f", "comment": "Malware payload", "value": "d16bc1a36da7f116e9215dd7137e82e638b7d6f7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362669, "uuid": "ffd34458-f707-4fc1-b016-8cbd92096e4e", "comment": "Malware payload", "value": "8a154e50c2b735d7cebd325a1656cb1a3bb2a7def238a98c724fa6774962365b891089026f773552be6ebba6d870a349", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362669, "uuid": "e1ffe587-c151-4e95-8ac8-1c1f03e861a9", "value": "T155E40173F60B097EFA1BC07750408921B87C95F6854B326FB5B0091A5897ACB5BB8BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362669, "uuid": "e9868632-7e71-47bd-9a47-20757ea1cfc4", "value": "12288:E1GSVG4nKScxVEZLJhAdo2672EIl00D1le+3MDjDpBu5ch66Hv4FG47:E1D9YVa/Ay7740ore+cX9Wc0UuGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362669, "uuid": "94a0a662-2fe2-4ad5-8f99-e2de4b671c56", "value": 659594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362669, "uuid": "edd72271-bc7e-48f8-b4e1-fdc34df109e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362669, "uuid": "d3df0ca7-aeb6-4e1b-8bb9-0f0ef492b3a8", "value": "ImmediatelyFast-1.8.61.21.4 (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcedee37-1594-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772386453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386453, "uuid": "e3d87c55-b218-4c8b-95e3-c3dcd92f12e6", "comment": "Malware payload", "value": "c8584bf992c3506f47de66b865e29081", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386453, "uuid": "35b8c7a7-dd24-4ac4-aea4-215c167cb21c", "comment": "Malware payload", "value": "20d256c2349fdda5ad309728c721275f5b9e6ead89cb4d6e391b58a99bb845bc", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386453, "uuid": "1ce57ec9-8017-4891-a79e-e39d73c9e431", "comment": "Malware payload", "value": "5e753af9972459a61ba2e79b5a13097ad22ac87f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386453, "uuid": "4f60e9a8-028c-44dc-9ffd-3c97a9ddb38c", "comment": "Malware payload", "value": "be1b9f5df0d611feed8c01e0a37722d4023f9e5c192cb388584080e96f9e173014faeff9e0a303dd14870ec9d560ee47", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386453, "uuid": "5341277c-f591-48c7-ad6e-83bb8823a604", "value": "T124C38C01B5C0C471D8B625350D74DBB58A3CF9300F61AEEB67D826BA5F342C0AA35EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386453, "uuid": "c28e3aaf-5171-480e-88c0-aa6b0ed720c6", "value": "9e2b52bb5ec60475db03de32800291c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386453, "uuid": "8c72722a-744b-4611-9b4e-ee2ccbfaf97a", "value": "3072:BhwSwQEKCaLL9ED+TcIhOxW5OVAcHnjqczymAQdn+qcuZeqy:Bh24PVEDWcIhjCH2Cbpeqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772386453, "uuid": "edb8d671-103c-4b42-8668-38ff3f19bde4", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772386453, "uuid": "e3daca67-f4f5-4af1-bd6f-3ff737ffb45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386453, "uuid": "3c8c27eb-7828-49db-a029-8511c168e5b3", "value": "\u53ef\u4ee5\u8fc7kehuduan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36acefb3-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396482, "uuid": "a7a4c10c-6a07-40ba-9265-fa79e7807d42", "comment": "Malware payload (Mirai)", "value": "d758da304d244dd22466863a0109922c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396482, "uuid": "89b553a4-c356-40fc-a7c3-3c481637e06f", "comment": "Malware payload (Mirai)", "value": "21b4d985b11622dbea23063551d83dd959870618a2bdb4d1ae9593919a2418ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396482, "uuid": "0c4887a2-db6c-4fa6-86b8-ebf5ef1961f6", "comment": "Malware payload (Mirai)", "value": "f0a0a37c4e14cc7cde323094c21b25ef5c200378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396482, "uuid": "325f0e4f-7914-4f39-91b1-38503245d41b", "comment": "Malware payload (Mirai)", "value": "d0d071c96f0b8426e711853e2b743c3886219b6ecedf3e51af3269ba066381a94823466361101fc2b9a11790a6fcd593", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396482, "uuid": "60211f71-4bdd-4bc2-a156-94396b68405f", "value": "T13FE47D9CFE4E3C42E2D7E2789E4D87E1722771E0D72391A37982430CD5CA9D98BB1925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396482, "uuid": "112dd395-0ebd-4fbd-ab6f-f40684fc8a2e", "value": "12288:qX/l7Q+f0jthMYsXI8dZnfsJxxuQldiYIblBOLgFXtjw5dWMfbaA:Y7n0jtdkZnfsJx4QlQrD/9em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396482, "uuid": "54321451-7c4a-49a6-9ce6-3822d0c48f81", "value": 701744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396482, "uuid": "38ad2865-10a5-4958-8fa1-2b21ebf2862e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396482, "uuid": "17d87fcb-4f5d-41cb-b615-960ede9e5097", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3753118d-15b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772398630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772398630, "uuid": "706c3144-93b8-4f5a-9789-a685a0ef8ead", "comment": "Malware payload (Mirai)", "value": "90fcca5c83e539793201b429a3a7213d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772398630, "uuid": "cbbe1b4a-55d3-4aa8-beeb-2d9397065167", "comment": "Malware payload (Mirai)", "value": "22383d75ec99f8b1396a0fd810ca966865f5e2140fb466462ae73a30b0b1fe7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772398630, "uuid": "7e899a70-f6b9-4ab3-951e-639320ca6179", "comment": "Malware payload (Mirai)", "value": "d162e694c5994b77e52188157e9493a8fbd0c48f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772398630, "uuid": "6daeddb7-0124-4a7d-80aa-197593ce84a1", "comment": "Malware payload (Mirai)", "value": "cb53c5dce37411f57ea0ffb44c269c4a9945eaaf26dbeeb5ab0cfec9b98142e5e88f00adb1217c4d4ae16dfbbe3216b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772398630, "uuid": "3d40ac4b-8a8f-4cea-a07a-3077f19d9ef1", "value": "T15E157C9DE786E0E1F56300F1025EDBF71534A12A5013FAF6FF492A6374327A16F1622A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772398630, "uuid": "74a378f0-e0ee-4815-a267-eff9608d30a1", "value": "12288:g5T2L+hjPk2ZhA9hUf4z5NeNzpilb695zfw0Q/yELLHPVPyt/kxSmLKOLu:A2LujP7ZhA9hb5QN8lbetHQ/hPaG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772398630, "uuid": "aa66257a-58ca-47c0-aaeb-1a81a580a40f", "value": 927384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772398630, "uuid": "9978c00d-c96b-4d02-a86d-da9b88c4994b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772398630, "uuid": "240b6968-96e8-4b0c-b701-a3ccd69f4225", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1992653d-1551-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357349, "uuid": "8d908535-53af-4f07-840a-4be2d6ea03fc", "comment": "Malware payload", "value": "d8674ff41356e01cb8d11b9cc8b44161", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357349, "uuid": "aae809c3-770a-4937-92fd-17667732e6a3", "comment": "Malware payload", "value": "22d4b42f0f6a5e9dfc8c2b67f45f67a0d37753071ffe6627337b09b38fb9b09d", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357349, "uuid": "d07709cd-3193-4e36-8b01-4b7fa7a80fdf", "comment": "Malware payload", "value": "be480706dc358088ef4ea4ed2d1ebba17a718a12", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357349, "uuid": "b2a4592f-419b-464a-80e6-4a38566eaee2", "comment": "Malware payload", "value": "c75f3f17eeac9d6b69e408ba8265df6bfbb4180b71c2d7ed4291389ca53ed72f03c0adb02347773381f66002172cabb6", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357349, "uuid": "5e26401e-e8db-47b2-a3fe-9b14b1b76868", "value": "T1DEF0B79949C5C6C27CAC4076B3731EB3196F4E4B2A4B1B03A94859D583DBF1424C73B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357349, "uuid": "eb0fd15d-f1cd-4c0e-9019-f072126ad7c0", "value": "12:oEOrn6MHLRAQFSWPFYtJCG9gkjD37xB3R8hV4t+GiorIBe16:ZOrLA7WcgGSw7qzb+IoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357349, "uuid": "a0e4df2b-67c7-47d2-b308-f0f9252047fd", "value": 639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357349, "uuid": "b1a17ff4-87e5-4ecb-b92b-ff40b781652a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357349, "uuid": "1279b670-3846-4aa1-a6a1-8ed399ea3321", "value": "22d4b42f0f6a5e9dfc8c2b67f45f67a0d37753071ffe6627337b09b38fb9b09d.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b932cd0a-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772385534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385534, "uuid": "3affa6fa-684d-4805-b91c-6e8fe0fe7f4e", "comment": "Malware payload (Formbook)", "value": "9abac2bc4e158623a43e1f2e6e396d25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385534, "uuid": "e64b0867-06f3-4a6a-bf40-0856ffb983d7", "comment": "Malware payload (Formbook)", "value": "23585f8aaa39c903f0f971cc68a16120d5e5f23365577709396c11d52fa8d83f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385534, "uuid": "d57b1a13-8d1a-411d-8ba4-1abc10981f3d", "comment": "Malware payload (Formbook)", "value": "15d72cebe285695a6a63f4129da9cca6cd85b6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385534, "uuid": "60882db8-f0b3-44eb-8442-bf87bbf1f07a", "comment": "Malware payload (Formbook)", "value": "202c66c9f62a608619cc4b8cd0a6f0e73f584ec6b4a93d2c962ca9ea565683ac28ba8a74f71a80c9b390f04c732de5a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385534, "uuid": "0ed76d81-8c84-4dc4-8583-e668df22736a", "value": "T16F35F06427A5CC16C36D173A18A0F17897758ED7B111C21ABEDD7EDB7B2EB110A82383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385534, "uuid": "91751f91-d7ec-4119-95b7-cb0e43564c9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385534, "uuid": "069ad552-218c-45d1-8196-8e7e45ee4233", "value": "24576:yOGpD6+awgnt0OiDNx7iSM6PKSy2rCjU6L2w9g+I5aO:yO2Qwsi/nPHHrv6L2aOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385534, "uuid": "706abff5-5800-4227-99b8-129b65383933", "value": 1159680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385534, "uuid": "2105299a-ca2b-4298-90c0-59a8e2ff1e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385534, "uuid": "11084cbb-ac00-4926-b0a8-4a68f26b7a5c", "value": "DISP-1354136_20260213102352.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1de808c-1574-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772372636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772372636, "uuid": "d8961b21-7a12-40be-8703-a875f465937b", "comment": "Malware payload (Vidar)", "value": "f41bfd4590fd59dbba50a5ac2b639988", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772372636, "uuid": "0f3c9752-3bfb-45ee-801a-82445e63abf2", "comment": "Malware payload (Vidar)", "value": "23714b6aba617aaf25cf9f9ee4afbbcb54fb634b8f6a0d467fc67375b80eb0b9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772372636, "uuid": "48a36988-76a6-4152-b9f6-dacdc833680a", "comment": "Malware payload (Vidar)", "value": "027ff5d3f6b6ee9e8de9aa7eaf2d90a95682415a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772372636, "uuid": "a5845705-8e86-4e73-8f45-5c070880e8ba", "comment": "Malware payload (Vidar)", "value": "e93741fd6168c0ed068744edf77eea4b1eb6f3c7d1d1fb98a89898cfbf0d1f220eb9401db2c4493c8841f1bec438fbd6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772372636, "uuid": "77387a3a-543b-4da1-a15d-2e3002e17508", "value": "T13CE6176B66618769F1DD823AC0BF8B04E4F373BD0733C6E782A00F681E565D44E7A664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772372636, "uuid": "d69e948b-0b33-4856-8a0e-a68c4d2bbad9", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772372636, "uuid": "b7bf4ed5-7ecc-471c-9741-d71bd4d58ed4", "value": "98304:5fbvYfLRXJbWCnI7jJd/8+p3kVDj6T6gxRXdQI:5fbvMXAoc3SD+T6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772372636, "uuid": "57791258-097e-41d5-b686-4da0d7431bb9", "value": 13950976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772372636, "uuid": "16cabf10-8a26-46ae-ae45-df6058e9e3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772372636, "uuid": "4b0c9dec-7574-42e2-a790-60783965ff20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0790c640-154f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356459, "uuid": "5141de25-8260-4ad1-8654-bcdc3f9bde21", "comment": "Malware payload", "value": "71fb82d669db05de8874268c3fcfceeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356459, "uuid": "64d1084f-a90d-4893-9952-1ac11fdf55b2", "comment": "Malware payload", "value": "2419ab809a939f9cdaa1de70b1a520e9b238a029d7c490f0aac76727f42a21b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356459, "uuid": "aaecd6cd-6365-4065-98af-72e833cbd344", "comment": "Malware payload", "value": "49eb8200eda2aacc2a2ed780e339df97ef13a4d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356459, "uuid": "581367f3-f504-495a-97fc-6261c4009e16", "comment": "Malware payload", "value": "25d5604d0f5db80d085ff68fcdc5652622d6b7d565355b57e346ce0e33762b3038c34b0bda7b59318f8e7f7c9407479a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356459, "uuid": "85ad786d-f919-4d23-9189-72946097dc0a", "value": "T18908E01663A116AAD97BD1388AAB6503EB73B4071330C7DF329C43712F63AE45D7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356459, "uuid": "16485012-6e45-4157-8826-af51ed2f8378", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356459, "uuid": "ebb6884a-a835-43dc-a2a4-fc3a2516a82b", "value": "786432:a5EosxTUU8XOkBKgPDlURVQp2WV1CVuVwoz3f4JMuBRWYF3eKKYdiaIFXEE9eW:a6oslbkJxURVQp2K1C6PIM6Oud20y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356459, "uuid": "2f9bfc08-bccb-4afa-8aad-c6d9cc159136", "value": 80857593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356459, "uuid": "7a20ff53-29c1-4222-b86e-b3f06c955621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356459, "uuid": "5cd39551-7380-4c5d-8da7-fc81660eef3a", "value": "2419ab809a939f9cdaa1de70b1a520e9b238a029d7c490f0aac76727f42a21b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36995f5-15ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772397577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397577, "uuid": "477f0e3e-f532-4298-9003-4f0a45376036", "comment": "Malware payload", "value": "f7f6f47e4ac319f8f55f9b82b10cb0b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397577, "uuid": "92765c19-7443-4685-b734-85c200cf8b93", "comment": "Malware payload", "value": "248d7c0e7d6537ac166708584ad0ef33519b8c8c6e87b194a4796f249d8cd601", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397577, "uuid": "0b67719e-ca2f-4b4c-96cb-c5c52a54ccf4", "comment": "Malware payload", "value": "26f5e2d6f604d4e04c8a422bfd8d97e179d568cf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397577, "uuid": "13d07d93-74e7-4aeb-84a2-40a1a18b6877", "comment": "Malware payload", "value": "b3f3e74f9b1a16d85ae689d11d837cfb9a9b2d6c6d3bfe48a9eb02bfb5edecd88c3097635be43f4c6fbdc4ce8e84cdc6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397577, "uuid": "456ad1a6-ea63-487d-b76f-7c884e1b34a6", "value": "T17A014C9CD17CDB81099DC686F2B051048490A0C7A1F4ABD5F24E0830AF25D49397330D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397577, "uuid": "80e99f07-2156-4fef-a5bc-b01f3ca9c9a2", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkQnjzLbR07gnv:FzY8k1/sWi2jkIjLO7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772397577, "uuid": "71d41462-3b90-4f6f-81b0-8a412d9ae224", "value": 669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772397577, "uuid": "4f49f50a-7cad-435a-8fab-8707c45a726b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397577, "uuid": "3a105bb7-47ec-43d0-a2b0-bb14839e4e8a", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2acd80-154e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356385, "uuid": "15999f4e-a2b2-4591-9596-3c63ebedf400", "comment": "Malware payload", "value": "c9dcdfefd63f41a6f368034444c67f81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356385, "uuid": "07e12840-12bc-4b58-9f52-8306bec2807e", "comment": "Malware payload", "value": "24b66b69e7168631a5f1e51e610223582f5d61bf313bd37eacc5846b26384025", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356385, "uuid": "ee4add78-aecf-411c-b1a8-7c2250346f76", "comment": "Malware payload", "value": "6c1054904b46f8ae96a3dcfa0ea059497eb2206b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356385, "uuid": "18f5e8c2-48de-4cd6-b83e-954e936103a9", "comment": "Malware payload", "value": "aa849165ea66c73b65f8aea2fc36336870c0eaf5637f6bea81297c5152fc4889c2bc801bab5a6f17ae05dc2d3db5c9c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356385, "uuid": "363ee833-d3ed-4ed1-9902-2dc26fe93483", "value": "T15408EF0663E116AAD577D2388AAB6503EB73B4071330C7EB329C43652F63AE45D7E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356385, "uuid": "84c33a57-eeb5-4c36-ad8f-26b825a8642e", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356385, "uuid": "e5246781-203b-43b7-88ba-893145df97dc", "value": "786432:6B5zM31we2iBrxDvIEMwHVCgPiQvV7URV17WV1CVuywoz3fqGCBRWYF3eKvVFuyk:6rA1wejHtLNURV17K1CNPBmOYVF7q1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356385, "uuid": "5d5e4813-a84d-490c-839d-8965c01ac998", "value": 81324646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356385, "uuid": "dd1cd2f8-f47b-4026-a58f-53a7cac8a7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356385, "uuid": "9d8108da-85c9-458d-a0a8-7a50ddef052d", "value": "24b66b69e7168631a5f1e51e610223582f5d61bf313bd37eacc5846b26384025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a54cca-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376208, "uuid": "2744ecb0-b635-412a-9867-742015f69948", "comment": "Malware payload (Mirai)", "value": "175ec7383c771636452e7ac8ff18286f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376208, "uuid": "cf2719f3-6dfe-4961-916d-195e4fba629e", "comment": "Malware payload (Mirai)", "value": "25164acf2c66b91aaae08639711e705759b25eef6f57f3c3b20def81c002bd2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376208, "uuid": "8032249f-7e6d-43a4-8639-2aed3ef69196", "comment": "Malware payload (Mirai)", "value": "6b64e9e567e53cc3b43874136b88610a48f17aa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376208, "uuid": "61eb14eb-de18-484a-90e3-003eff20a5b2", "comment": "Malware payload (Mirai)", "value": "23f59dcfcfa49d41ac87e8e77a44c931a1557189d0c05dec9de9e63f796d65fb58be73259780a0bfa2eb4a14e69420d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376208, "uuid": "4244cc65-91de-4520-a546-5284ad5bc9c4", "value": "T133E31A077AC1CDFFC886D1F04BEA68358A62F92D1535719B6B94BEB11E0DDE12A1C720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376208, "uuid": "9125f0ed-8690-4f40-8018-05de51c9c72e", "value": "3072:3AoL43t1s+cNu8tNcsNXWqeW2ewskJ+Y0EWa6OiIjThvWf5ml:/L43kgrcKNW9OZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376208, "uuid": "68024a52-0281-4348-aed4-64bd05ffe214", "value": 156752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376208, "uuid": "db027eae-20cb-4184-8c7f-956bffbd5e16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376208, "uuid": "f39c3702-69d6-439c-b1c3-2ac95d999d49", "value": "nx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d624d3-154f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356535, "uuid": "810e41e4-f899-462b-9694-c142d9408272", "comment": "Malware payload", "value": "1aef75c0dc91f54b832aef7ba1fe86cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356535, "uuid": "55c07c42-c337-4c88-9b8d-9d599e271c97", "comment": "Malware payload", "value": "25266a9c870afa5df2d3b6833a30419fba370ae2c6aa83acbb3ca21b91ac1aec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356535, "uuid": "6ec75f7f-f142-4a25-9ea5-5cff76fffe83", "comment": "Malware payload", "value": "27c9195a9ee5313b65675989a3af360ca5a45779", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356535, "uuid": "30f0564a-c504-417f-a67c-092a83eacee3", "comment": "Malware payload", "value": "feca4996b15e4ba5cec12ba32093664e78c4dc280c574fb77600e6a7d24eeba8df290a3e284e7b0039efb5aaf23a1baa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356535, "uuid": "7a3088e5-86a1-465a-8375-fe4db9c5e606", "value": "T1F5925DB512896C79FBD1CE39AF3C6F4DADE9C2C42124A3ACBA4F39205A1166DC70534D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356535, "uuid": "5246a26d-109a-4bac-b955-2954ff20c3b3", "value": "384:3fcuQpWx+BL0SWL0g1zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:3f8i+BL0SI0ezsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356535, "uuid": "1404950e-878b-478d-b6e3-411d96ddc9d0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356535, "uuid": "7e5fd2d6-74c1-4199-af9b-91a17286d477", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356535, "uuid": "9304c0ad-e539-452d-939f-254917e4a193", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23492fbe-1572-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772371538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371538, "uuid": "64d13824-f1b2-48b2-aaf5-1c70ba899ff9", "comment": "Malware payload (AsyncRAT)", "value": "9a8268155d9cbf65b506b07eb3c58d03", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371538, "uuid": "595ea6be-f3ed-41b3-a4af-cfe025223c22", "comment": "Malware payload (AsyncRAT)", "value": "259bbd6c24a58f46519c8989bbeefa33c040dba6dc5edc60210b39141b9d3242", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371538, "uuid": "b6b60102-779c-4582-a866-928ff4558622", "comment": "Malware payload (AsyncRAT)", "value": "34ed87bc71758471a2e49782af8a0246a892636e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371538, "uuid": "4664a70c-d9ab-4d67-89f2-83933f42aaf8", "comment": "Malware payload (AsyncRAT)", "value": "a6938e4e61014260c10971df375f1b732aa4ee12fe082943e9da8f712eacf5b3de9bb8a8214ea11543589c48ee0143eb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371538, "uuid": "12092271-1c47-4e0b-8d85-f82a401db70d", "value": "T1ACF24A0573E59665E1FD0BBD5C3686044376FA474D62DBAE2EC450AE2A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371538, "uuid": "f6a7b023-ebe6-4d54-a6ac-1e12274ebb26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371538, "uuid": "5fc2b91c-cad6-4809-8d4f-056f23d7bae8", "value": "384:kMTZPkBc13ohM9oehElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCqwWW3EN:kiZPGc5ohM9BhT1hV4RbJwB+WWs8Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772371538, "uuid": "22b264cc-602e-495c-aadc-639242a06263", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772371538, "uuid": "0e9935cd-75b6-4daf-a80c-4ae92e4034db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371538, "uuid": "fdd335dc-1ab9-4fad-91fd-630a73507ec9", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb9f46d-151a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772334107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334107, "uuid": "e346fae8-a34d-46eb-8958-57ee9673101c", "comment": "Malware payload", "value": "4af7318c67c684acfc3f21c2da3ddf4e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334107, "uuid": "faa8d86d-d7a9-4ab8-a10d-e89308a7dd1d", "comment": "Malware payload", "value": "25b6d8bbe40affff5dba4cf204ec6875867486d8cdef1f23c5f4dc70ebd62042", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334107, "uuid": "00f49bea-8296-4688-a1b2-075d8560b85a", "comment": "Malware payload", "value": "68ddc107c9779e6d85e5495a2c79f79080841307", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334107, "uuid": "6be7e1dd-8a81-4ddf-b95a-0097643ad8a9", "comment": "Malware payload", "value": "e49f483f4069f5bc2be104349bd1750944c3460a8de460288460fe203a93626b277a4380e3d2780ad91ca07e6e742965", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334107, "uuid": "754b7a6f-1618-4658-8ea2-64306a35b1ba", "value": "T135F0D352B9557E159331C81E57C17A46173217F1BC58B93D54D489C24FB54C33166B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334107, "uuid": "2b49406f-637e-47f6-80e4-d5be24fff791", "value": "12:8q0HsOt1Vvhs8SOQHHRrsQ2nXMASo9g/g0tv7kYV0VyVIVs6X:8RHsOt1xhDSpNS8ASo9gI0tv7JmYCS6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772334107, "uuid": "68b32e9f-ce10-45f8-888d-14f158715f89", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772334107, "uuid": "00ccd810-36d9-41f3-984c-0da351319e7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334107, "uuid": "10f59981-d90d-42ad-a48e-4e5d0aaaead6", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284656d4-15af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772397746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397746, "uuid": "0c0d1459-6437-4388-9eb0-72f6eea0022c", "comment": "Malware payload (Mirai)", "value": "10a51907a6eead2081ddf731cb432b12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397746, "uuid": "838af3e4-6be1-49ce-8650-403ff3dfad01", "comment": "Malware payload (Mirai)", "value": "26373baf132e31821ea2e91ff0f5c72b790492c6cbae97cb635a47ef21b5e840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397746, "uuid": "e47d65c1-3f6d-4350-ac67-6dad6b374f5d", "comment": "Malware payload (Mirai)", "value": "66b50d5d36cce952872601f9cefb8959984151a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397746, "uuid": "f12a48c0-ee20-4215-8a22-f9da0dcbfe6f", "comment": "Malware payload (Mirai)", "value": "e8692fadb11c47f2176809233bb394377460dba4297b54b5ea1d0f2632a46fdefe6f73ff3257aeb8456c91397df415c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397746, "uuid": "242f276d-09ea-4adb-83b0-e257650a3b2c", "value": "T17FD30756B9919F11D5C321FAFB9E824933136FB8E3E93102DD206F64238A9DB0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397746, "uuid": "79109dee-a6bb-4049-b5bc-93a90146789d", "value": "3072:AZtbZDNjkNRiBwFSN0Pp7oHdxa52nvYmuMIGlezjCcL+pFiP:wJNjkNI2cNWpYDa52nvYmuxGlsCM+/iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772397746, "uuid": "44a82e77-f701-4cad-9fa6-e5adc764ff90", "value": 141968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772397746, "uuid": "03894033-bd8c-4ba7-a873-bb4176358b4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397746, "uuid": "2e92a6ab-2d3f-40f9-b26c-ede16c73587c", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209f8ffe-1551-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357360, "uuid": "f0433ab0-d8e6-49d1-bc29-d80734f792d2", "comment": "Malware payload", "value": "661791e0149f7ad493bafb819b2a25e7", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357360, "uuid": "4b3edaf0-27b7-4583-afb0-53b6241a3f6f", "comment": "Malware payload", "value": "2774add319afab6c24f419826c166800c7e7e25e25997a1afc1b2c56a8ae0c79", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357360, "uuid": "be9a113d-a41b-4654-a119-b5c81f6b2446", "comment": "Malware payload", "value": "128af5c5548820b086cd318fc31b58650155dd09", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357360, "uuid": "d31b7596-403a-4e14-9243-bede4a4f1548", "comment": "Malware payload", "value": "f14f18beea588d73ab16a93e7ecdc879db9cf289e22afcca6905a7385535e2a6fa7ca696c7aba69b5c9dcda1010fa910", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357360, "uuid": "858316c0-6654-4f1e-9294-0053bee13c80", "value": "T17E35592878BB90595477FF913DECB9EBDDDE2A636509681B1085030B8E12F80EE4793D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357360, "uuid": "69276698-d6f8-4020-8e74-743f63f93db7", "value": "12288:Pyoz8rmJ7hZq596m/A1zvrzYcmHIs+t3wq8eWQeJW1QEvp5kT/V8YrwasOMFRxVZ:+IW6sxugHAjU7euP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357360, "uuid": "6fb02a36-5449-4be1-a4fa-dc96cc622551", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357360, "uuid": "d0faaecc-2397-4526-8149-9776e4fc8788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357360, "uuid": "7a9d9759-c6aa-44d2-82af-b15f1872899d", "value": "2774add319afab6c24f419826c166800c7e7e25e25997a1afc1b2c56a8ae0c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b140b8-1544-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772351784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772351784, "uuid": "2f21befe-30c5-4ca6-9804-830569667101", "comment": "Malware payload (AsyncRAT)", "value": "4c4d2d00acfb67e70442b424f88ec04f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772351784, "uuid": "477905c5-83b4-47a0-b2ca-30f8a014222d", "comment": "Malware payload (AsyncRAT)", "value": "2ae2567c587aab6938a5e05b5db1ef2daff2b98e72b3231ca932d7d877945bba", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772351784, "uuid": "ad250ff2-b15e-41ea-b4a9-447ff0b18a31", "comment": "Malware payload (AsyncRAT)", "value": "35c13116a20f4b380678644c22a0106c28ef726f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772351784, "uuid": "38217092-1a8f-4740-b75a-df302da509a9", "comment": "Malware payload (AsyncRAT)", "value": "d361771379098cc5d26c97af0f4fe97738978ec5455d99079ec469b16cee157c42c0891cbdc7c2096846c274c9422b7b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772351784, "uuid": "f376f548-3d3b-4183-976b-83819cd67e28", "value": "T19EF24A0573E59665E1FD1BBD5C3686044372FA478D22DBAE2EC450AE2A237C8CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772351784, "uuid": "70726a30-0c19-4073-a8a7-7b23015a2cf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772351784, "uuid": "9ea378f5-03d6-4aa8-bd0e-6e8b48b77f8b", "value": "384:4MT5XY+17Ng15KhElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCjpEWW5EQ+:4i5XHRNg1IhT1hV4RbJwB+WW3eQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772351784, "uuid": "325f23f8-913f-4b17-b5c0-dbe7da241b69", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772351784, "uuid": "c492dd85-67ed-4f83-9704-81d8a70a5d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772351784, "uuid": "3b30d026-2fe2-4589-b7fd-cacbe6f0378b", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb65990-15b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772402293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772402293, "uuid": "1064d8a2-9b44-4b91-942c-8d6c10ed7f04", "comment": "Malware payload", "value": "8f9a99325276f79f175877622b5f1f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772402293, "uuid": "63a9a848-69fb-4c73-ae40-a2160ad06998", "comment": "Malware payload", "value": "2b11cdfcea4d3388efc4fd1c5aab8e3c030c023dc0ef9a3b16c20ae731c6d2e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772402293, "uuid": "14328f60-c40f-43d5-a5df-b0bc144e60d6", "comment": "Malware payload", "value": "81e56c36788f631c908c3af9d08c22cdbe84ebfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772402293, "uuid": "3239b226-c8bf-4e64-ae21-c1979b8feb11", "comment": "Malware payload", "value": "4bd77d58104e64132227e9f16298d86d978b0882c5913fdf4dbcd63acb1b3b06880d0d43574ae5f8a0f0023a48ce04c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772402293, "uuid": "73fe1e42-c296-463c-8e6e-4c77d858e7a7", "value": "T1BCA68B41FDCB10FAEA430A3105ABB27F23315C064F65EBD7EA007B29F97B6951936249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772402293, "uuid": "c1130ade-1539-45e4-8c67-406acea66f04", "value": "196608:zSK1SSgAdPKoC1wGT3PRGXnzDlWH+ywSf:WQIw+ZGDDlWHB1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772402293, "uuid": "9b9b671b-3917-4658-a72b-8d5a7e42cd29", "value": 10233645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772402293, "uuid": "5fbaff3f-7ffb-428f-95a1-34fe7a51a5d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772402293, "uuid": "aab3aca6-8e8c-4376-b212-431669a3384f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96503665-15a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772395354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395354, "uuid": "8282147d-53bb-4db3-a715-1725d62a1324", "comment": "Malware payload", "value": "f0670e0e39f570f128b32e4963dbb82a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395354, "uuid": "9dca3631-acb5-496d-a9b1-edc447a0f4b8", "comment": "Malware payload", "value": "2c751d1177672240cf619f700c37f83c40432fbca337f92fcbbee7ae457ee16d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395354, "uuid": "3b33c962-1dc4-4788-90da-1827dd9fed46", "comment": "Malware payload", "value": "3b06f7e644077b68dc4bd72bb9ad553d19cf00cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395354, "uuid": "d7d2510f-8886-4956-aa4d-42020d4247f4", "comment": "Malware payload", "value": "44798ffe26777822682ba911922c1007c3ccf741a4d764c4f621757953302448696dfc9e2d36868f6b8349f98cababc2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395354, "uuid": "aefca0b0-a2d4-4af2-a808-e3f1cdfbc523", "value": "T13CF0E1A514E13D102BFD5F0881904B1C80733B21F256BF5466E18BE95F5B4443219388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395354, "uuid": "1644204f-ed98-4f49-9b36-85253a1971fb", "value": "12:MquhRnFxvhsIXmuH9B+S5MGAffHecx8OG1EcWUYHj6X:MfnnDh7XvMGcH/KHeD6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772395354, "uuid": "d1c75e0e-a5ef-4f3c-a876-a177c2abf000", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772395354, "uuid": "11bf1566-a1fe-468e-a439-72276faf8cc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395354, "uuid": "05ccf4d7-3e37-4ac3-92e0-5afdf483bac6", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926d75d1-1583-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772379026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772379026, "uuid": "6ddc22eb-9816-4225-83f0-fc0455c4617c", "comment": "Malware payload", "value": "da3ae1163d5e0604d9b3346052c0ecc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772379026, "uuid": "ceaa2825-d9fd-4d42-a55a-9dee0bad13b3", "comment": "Malware payload", "value": "2de9d9906df97a742f37a15b0926b204a1c049e25ea361339db5f8b9badd643d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772379026, "uuid": "b44b99d9-1697-40a8-8e66-79a66cb774b7", "comment": "Malware payload", "value": "8d3518764743de5526fc4374496633e7e7f22d49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772379026, "uuid": "d9fc5e6d-334c-4505-bafc-eff599fe465c", "comment": "Malware payload", "value": "76deddb3bc5b1390b47670a5a61e37ce33f73ad4863318f9d967eb160f2b978b15534d03e1a0c437e7e68b0d7fe408e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772379026, "uuid": "b91dc314-39a1-469f-83e1-e8784998ae35", "value": "T159E6076B66618D68C11D813AFC628BC3D7F371B90722C2E74E6C03681E569D37E7E624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772379026, "uuid": "e458ee75-a118-42f0-969e-4975c918bd70", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772379026, "uuid": "8265fcb3-0b4c-4445-bee3-57a67eb44466", "value": "98304:6fbvYfLRXJbWCnItjJd/8+pFV04a0dQI:6fbvMXWocFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772379026, "uuid": "45812711-993c-478a-a01e-9875af8f29f8", "value": 14362624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772379026, "uuid": "52e8872c-aa28-49fd-890c-b27d1569cd45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772379026, "uuid": "2035222c-9827-4d0a-9c92-bf742b334898", "value": "SecuriteInfo.com.Win64.Evo-gen.68753647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f70949d-1564-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772365492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365492, "uuid": "a4e24328-52e4-44d9-a775-9cf69b04085e", "comment": "Malware payload (ScarfaceStealer)", "value": "ae4690dbe3da05eea3548cf01f28dc2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365492, "uuid": "c758d5ca-e408-4517-9042-9fe54e822fde", "comment": "Malware payload (ScarfaceStealer)", "value": "2dfeb337577ed2771289463990d6f5056b2271608a5b755d2db19559daa41b72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365492, "uuid": "09faee49-be06-46c7-9675-8a9221befe11", "comment": "Malware payload (ScarfaceStealer)", "value": "0530ca032e03315942213f96e377d8889a234cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365492, "uuid": "92a9ec84-3403-48ff-a4f0-d6ae2436c4b2", "comment": "Malware payload (ScarfaceStealer)", "value": "d2a378b9dacf4d3d48c2e2ccfe8b006f5a6e7a934e147bb6ac31864af6042ee5baedf6e732a8a0d8d8efd404ea707e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365492, "uuid": "449fd2b5-99ff-4d89-8bc7-b85797fb76a3", "value": "T12AF7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365492, "uuid": "39005683-a561-4266-81a5-46b9257a118b", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365492, "uuid": "dfc4dd64-38dc-413d-8e24-af7b311cca82", "value": "393216:Ln1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:L1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772365492, "uuid": "c708824f-e033-4c6a-9113-dc543f0b6f02", "value": 71366656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772365492, "uuid": "dd10c0a9-6c51-40c5-8843-9805fb5dfe94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365492, "uuid": "616a4523-9557-4f61-bce4-16e4d6f8324f", "value": "Nexora.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab48e0d-15ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772396945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396945, "uuid": "0fcba00d-6bac-4085-959a-4dfac98c5f25", "comment": "Malware payload", "value": "cbab23af34215e287249e683cc075327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396945, "uuid": "520d080a-e1b9-48a5-a581-ce6beceea1d1", "comment": "Malware payload", "value": "2e04a52530d3ed28a4f7b8aa82f7b1c753a795c93dba00c6bf3c6f940111d571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396945, "uuid": "4ecedbd3-d09b-4f02-b0f0-03234e33331c", "comment": "Malware payload", "value": "454b29a6e9ae37edce149bb03f04ccb8a68980ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396945, "uuid": "1d886220-86fb-4e51-82b8-8fdf78eecbc5", "comment": "Malware payload", "value": "8c6a207d1dc598b429fe36b76600b2da2619e19f5b20e2341c160b6a8456d2ed445088caf4d238899c5a75d941fc43d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396945, "uuid": "ac6362fa-1284-41ac-97a3-ac38e43a6b01", "value": "T1F4E6286B76A18669C21DC23EC0B38F01E933B1BE1B73C7E753A102685E4A5D45E7E670", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396945, "uuid": "1e60d20f-50bb-42b3-83c6-03eef4e6bbbd", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396945, "uuid": "0a8ec03e-7d65-4676-beec-1e5fc7aee337", "value": "49152:7fH6uLQa7DDHSgaVxb5uBoWVCJGSVOvfz+ZyefFAkOILbvSy6fWixMGwOI/e8bBl:cfbvYfLRXJbWCnIcjJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396945, "uuid": "63e10ebd-e799-4de3-95b6-ac2597f8bd57", "value": 14486016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396945, "uuid": "103530bb-dbfe-4bfc-b84e-35d5dd90efbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396945, "uuid": "0ae7ecaf-f138-49ce-8931-ac0269f39be4", "value": "SecuriteInfo.com.Win64.Evo-gen.77383222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fb44ca-1519-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772333264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772333264, "uuid": "624d4361-bcb9-498f-b12a-21893d57ed19", "comment": "Malware payload (Mirai)", "value": "0e93e8b725e42feec3fcbaed387a15b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772333264, "uuid": "344fdaf9-07da-439e-9377-39e1f7588cb5", "comment": "Malware payload (Mirai)", "value": "2e057303b339b9189a86854f12a00bf346561aaa66cf10833e78c499ed8b416f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772333264, "uuid": "952eb1dd-a378-47a1-8bd7-5f9859a02949", "comment": "Malware payload (Mirai)", "value": "404244005403054fc79a72570cd827a1f3c7f925", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772333264, "uuid": "ca9a6ac8-43cd-4a01-9150-e942420326cd", "comment": "Malware payload (Mirai)", "value": "bdcb81d5db831020445b1d61bd63cf822706bebd738b10ff6bc2fa2e8679dc935df583cc527f3dee501ff40092431b0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772333264, "uuid": "b1ad7146-7d1c-4f0f-85c7-20358d876cf4", "value": "T14C135C45F30C0653E2631E70353F37CDD3ABE99011F4A585292EDE89A3B6DB25149ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772333264, "uuid": "cd75e21c-06c9-412c-80a9-eb132d586fbb", "value": "768:Pd4ybmSuqCDaIF8jREaTrvc98oofsamSe5yGvF1Dt/3gIIfl:P2ybmSuqSaICRpT68vkaPUyODd3gjfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772333264, "uuid": "86268e85-9c0e-4956-8296-8bfdf75261ec", "value": 44480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772333264, "uuid": "f066d998-e4a1-458b-88d6-da71a66dc215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772333264, "uuid": "5a06724e-727f-435b-a239-ee1b44326a5d", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025a1a97-1552-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357739, "uuid": "cbbe308e-d0c0-4616-83bf-265581072efd", "comment": "Malware payload", "value": "b03f32c7d4533783fcf8a16dc130ad2d", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357739, "uuid": "15e57b43-7608-4eea-9872-147b938b0914", "comment": "Malware payload", "value": "2e7a6d2383339e917b40d32cfad70fe020dcaa93c14df334bd829836074e90c4", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357739, "uuid": "fb6aea2a-68c8-4a3f-b21b-b32b5e4aa2ad", "comment": "Malware payload", "value": "fb4510fe85901fdc66013f8f520cb49e7b43a729", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357739, "uuid": "3e113482-8885-48c7-bda5-f823372faf2b", "comment": "Malware payload", "value": "f17b94d5581568335d1755b706cd7a66ad5e542ad3f6e3abc4a4e0f4e84d91fddeb395582fd48137fa1bd6b2695ebb66", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357739, "uuid": "d358c32e-0d00-4bbb-9c9a-40ad289e7c2e", "value": "T1CB11F01B1367743E4F2856A5E13E1601EA0841133280528333E9D64F9E3942BC7C1BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357739, "uuid": "657d4cf7-1ea8-4bf2-b58e-21e6eb2ca702", "value": "24:Q7+3Fueu+5D5h9MkbMObvuVMhLaxdJLax1YVyeLaxdhpSpLaxd6h/LaxdJ:ysursDnB4quHAsVyleUbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357739, "uuid": "6d43266c-15aa-4f23-b9a3-1495d48bdfea", "value": 1069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357739, "uuid": "baae95ca-550d-4964-bc76-3d9b66eeb280", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357739, "uuid": "16e4b646-aa10-4dd4-90b5-a7e358b98277", "value": "Embargo1019988084452389741436257300093198601.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668d9f04-151d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772335144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772335144, "uuid": "e2a030de-4b60-4878-80d5-77820ccf658a", "comment": "Malware payload", "value": "d197c687159d564efb78db9c4fb4d29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772335144, "uuid": "91f22a13-5b9e-464b-a74e-5cce948de78b", "comment": "Malware payload", "value": "30577961b8385513744ff7dadade82b2a63f8fb2f4355dfa7ff13a067119d281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772335144, "uuid": "3cd93e92-c059-4b09-b89c-977ffca5cc66", "comment": "Malware payload", "value": "ccf2cdec7ac1e602b424c9c73c262e3d4e115086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772335144, "uuid": "40436150-0aa4-4c36-b616-07bbb96ad40f", "comment": "Malware payload", "value": "9e71484cf681f1aecbcc9930ab0c5f160e4a518ec8083f380fb6ad9a07806762ae72e0a10d02f427dc23d285cfd981ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772335144, "uuid": "9dd6f6cf-a4d9-4425-b264-844df01dc4a2", "value": "T119F53391F0249F21C51BB074F423E9F07783EE78092EAA057C6F97816DC3A742755AAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772335144, "uuid": "06654ae5-7220-4671-836a-70770d45da95", "value": "b484b52df60e8d823b647a09bb1e39f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772335144, "uuid": "4234d1f5-eaa4-4e71-83d0-a51164676461", "value": "98304:vcKxvQv/wuMiNwjDc/cpeMJAwsSInZ48EQNCekd:mGYXws/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772335144, "uuid": "10b3dca6-32be-4f8b-b13c-71340dae193a", "value": 3440096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772335144, "uuid": "76e5ba54-4d36-4df9-88ef-2c88f6a77b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772335144, "uuid": "24de9c8d-212c-458c-824b-03ce829b6d7b", "value": "165-018gx\u5b89\u88c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4fb1bd-157c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376201, "uuid": "62e0e635-d509-4481-9e14-27693db20921", "comment": "Malware payload (Mirai)", "value": "0c39c131c5eafb938d3e235d884ffc0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376201, "uuid": "d9262d45-a490-4dc8-aa25-3f5411ce5a90", "comment": "Malware payload (Mirai)", "value": "30944a7b2d6e2a5e9e355dd9de15b2acc5bc0cd9a2fe242c2466b933167f92df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376201, "uuid": "ba57eec2-8f84-40c6-9d66-8bb3eefda999", "comment": "Malware payload (Mirai)", "value": "edc163aa2281a602fea2d387a6187737cfbd4053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376201, "uuid": "d97577fe-f6cc-42ea-ac67-1a4336f11e71", "comment": "Malware payload (Mirai)", "value": "98a32003862437af33997293b7372fd3a695820221d2b7996800e89cc0d3dd0f721cf19d77fd78a8f9e8f3bb9f2fb63e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376201, "uuid": "d8782063-fe5e-41af-911b-9e29ea67b76e", "value": "T14DD3E842BD418F13C6C322F7FB9E42987B266B6DD7EA3102D8257F54378A4D60E36252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376201, "uuid": "c9c97e6f-daf8-4ade-a51c-cd789278164f", "value": "1536:nh9HoCtxP+o5962fNknd2UoeI4V5IA+b+usuIulLOwywyIQjv3vwxzytPP7y3F3F:n3Iah+o7Gnd+4oA+K9u0vwG7ehmzQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376201, "uuid": "468e27e0-b751-4143-82e1-bd28cb678868", "value": 142992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376201, "uuid": "d69eae20-5fd0-4191-b5c8-c6035c6cb5df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376201, "uuid": "953dba7d-447d-4707-93ed-2b06e4566c9f", "value": "narm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0130d089-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376206, "uuid": "ef4a1517-e47d-4a2d-8b4e-1ff6758e46fd", "comment": "Malware payload (Mirai)", "value": "f01c5b48a4efe856ce98f168d7890798", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376206, "uuid": "6bc1af59-48a5-4b2b-a48e-2f8fd73caa63", "comment": "Malware payload (Mirai)", "value": "34105f259d7faab6a80130e9fbb1e457611422261b9265d2ca418202cecb16bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376206, "uuid": "a49a93c7-2734-4f26-9ff4-387c0d087aa4", "comment": "Malware payload (Mirai)", "value": "eebd95609924a24730811b18a3c98bbf22bab206", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376206, "uuid": "0007d413-0556-4425-a81b-6460aa27f5f8", "comment": "Malware payload (Mirai)", "value": "3bcdeae8fe43e7a306a173aac84b232b105fb97ffff1c593193e270ffb7b1b4914f40f667013359dd9a5a28bf1cf9baf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376206, "uuid": "a31506c9-b86c-405f-89b9-04ed86ee496d", "value": "T1C1E30706770D4F03D1532DF03B7B4BE0836ABD5228B9E584711AFEC993B19B2A506E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376206, "uuid": "4e189672-9091-465d-8eca-315b484571df", "value": "1536:7BCb1yIvQ9tvL107vkeveR2xlbDiOU2q2g89QiXnvAKuHmGOcRiQreuA7avDRrNF:ob1yYQHvL1pAeYxtizG9QpKzQrNRrrcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376206, "uuid": "eedc3d84-f7b0-4459-9ebd-717c728ff68e", "value": 151352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376206, "uuid": "3aa85326-0709-4b0a-bf66-2b2fe13ff58e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376206, "uuid": "bb5e2aaa-d30e-48da-b387-b7c220eb9c4b", "value": "nppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6155d24-159c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772389850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389850, "uuid": "61b8de55-b295-43a2-a624-4e5cee1fc7e0", "comment": "Malware payload", "value": "4da694f10eecff946c4eb0d0c48f4940", "object_relation": "md5", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389850, "uuid": "7c9b8d15-2b5d-4f17-a032-4e920e3dcf8f", "comment": "Malware payload", "value": "34c240e0decac9959be2b5a3a96c7dbbbbe3b2db6543161c2605c36f3815a2b6", "object_relation": "sha256", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389850, "uuid": "9df7da0d-3c5c-455f-bfc2-d118b9590a47", "comment": "Malware payload", "value": "b2bd2f0c9181e878ee6879c4aa071f849fbc6c9a", "object_relation": "sha1", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389850, "uuid": "16a5f893-ec8f-4615-b5a2-d4338bd6eff7", "comment": "Malware payload", "value": "22e55faee5c2460ca796d12a972bfc49becb1d981e4119d355e3f78f8c9a2b627a363ce40e5899ae97a9031b292c0b80", "object_relation": "sha3-384", "Tag": [ { "name": "a3dacb", "colour": "#376450", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389850, "uuid": "07fa83ea-82e2-4338-a9aa-cf4729ed3009", "value": "T1B4E6338453D14A66FAE7E13D45A7E051D1B2F8105B228ACF4FE44B673F1B2E14E3AB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389850, "uuid": "624c61b3-fada-4567-a3d6-d639fa026139", "value": "74f4f918cc15caa2178da4a8adcd29a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389850, "uuid": "07fc2b76-1581-496f-b6d7-9031f996fdf2", "value": "196608:UPApNMDftbW897GDr/x7eovq5XMP6PzFcPVz097WpHskNqSPrGuZRjMFqbH4Mirc:W1yNdq1B7iR0gpHskqSPjZpiqbH4a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772389850, "uuid": "fadef0c9-83d6-42a1-9478-82cf8aa48cb9", "value": 14060032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772389850, "uuid": "4588d3a6-4391-45dd-b3d3-c7a253c3f721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389850, "uuid": "8d8cdac0-0f56-46c6-8e4a-82840a7b5b50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f94ad7-1517-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772332405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332405, "uuid": "b2c57a53-aa4a-4352-9a7c-2474689a2069", "comment": "Malware payload (Mirai)", "value": "1af6136740e6defb5fd43dfd7c7b695c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332405, "uuid": "3608ef9f-13cf-4719-a006-a6f39dac649f", "comment": "Malware payload (Mirai)", "value": "34f5caa5404b0daa820c3d62be6bc4add206cf98e32205416ff327646eee9110", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332405, "uuid": "a4e033b8-0394-48aa-8a62-0b66e7949be1", "comment": "Malware payload (Mirai)", "value": "93d973ee2f6bca900455977bb053526d4e9b1d39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332405, "uuid": "8502e7fb-9f3b-44a1-a02b-0942919fc04e", "comment": "Malware payload (Mirai)", "value": "f6b450f1ac221b1ea4de14c83abbd4c0edc30c76f56f465479e10bf9f16b2d61d83a98840cfc376bfd61afca8866e886", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332405, "uuid": "68578cb0-4916-4b0b-906d-2789707fa45e", "value": "T1D7233B35BE724927C4C0A53661E3831AF2F6839E14F84B1F7C720E9CAF64A9425577B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332405, "uuid": "c92ace8c-3251-4a13-9209-3271ec531471", "value": "768:FYJSFWHwY4AcZOyvmMDD8d3M86pM9O+i5ou9n8NaD/DS1tbIQZ:FYgF2wNA2XTDD8d3aIi5POJtbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772332405, "uuid": "ab8271a9-0345-4cc4-9862-eae7b850328b", "value": 46960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772332405, "uuid": "adeaa002-ed04-4246-adb6-eff4dced223b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332405, "uuid": "a17701b8-acde-4ab3-9c3e-bb2d15b55489", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3193dc72-155b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772361684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772361684, "uuid": "1cc35474-a250-4d1b-8f07-ee62b5685f22", "comment": "Malware payload (Vidar)", "value": "7290ff21268ad3cbbcf0fb6ff569dc87", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772361684, "uuid": "1cd9cde5-253a-4681-aff9-de3b8a5b1a15", "comment": "Malware payload (Vidar)", "value": "35055f51099a1553dc1c61bd9ebe391d2bb27ccc12552aef01056eb51bf145dc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772361684, "uuid": "218d1563-9dba-47ff-b1af-bfb87a673c0e", "comment": "Malware payload (Vidar)", "value": "36a20188be7f6e3aea899522110d0a7b753395c5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772361684, "uuid": "b3f3c49b-c522-4938-99f8-e2e596c7aba8", "comment": "Malware payload (Vidar)", "value": "704a66f9b1dc6b325b6e8cdd5b2794fc6edc4139714144ff2e82c019d0901352a7ff9598b5d9e1fa9e7b0ca9ad352aa0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772361684, "uuid": "6055ba74-1dbb-460f-8ddc-6e6b48dcadbb", "value": "T13496F62BE2709578F1D9813AC0628E90A9F3707507F6F9E711C12B595BB9BD08D3A738", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772361684, "uuid": "6e68c66d-0036-4808-8b7a-db7c5270cfd9", "value": "2549ebf941b5f40c69593fdeea32a946", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772361684, "uuid": "2af33245-314b-46da-a852-60707a6a850c", "value": "49152:fa6jgnfQVCpf+DYEuUmK1N0TqUacS1+UySCFLgpoQB5sIR6l3x96WoeopFN4Xgam:fSwUK/xaHoeojNE9PjqyPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772361684, "uuid": "6fd90bdd-1c85-495a-91e2-28eaaa3773d8", "value": 9467392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772361684, "uuid": "77db9211-9d62-45c9-b761-961efa95f01f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772361684, "uuid": "b57821f8-e697-4658-9c3c-5f49f880d95c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffeb32b9-155b-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772362030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362030, "uuid": "4eb5354d-8fc2-4898-9593-9c8704bd8f41", "comment": "Malware payload (Vidar)", "value": "00e31431b60f9392d18170850ef37aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362030, "uuid": "fd5ca0d6-0189-4a3a-87c5-96792c21bcb2", "comment": "Malware payload (Vidar)", "value": "360282cd728b42842d08904bb64af368f40901a4435fe1e339beba48f2e3e70e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362030, "uuid": "db6f2d86-25e0-4dd7-bdf9-8fac77e65247", "comment": "Malware payload (Vidar)", "value": "b698f7de4fc0cc6882000f427d1ed12ea87cf70c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362030, "uuid": "1aac57bd-8d9a-4867-b0db-3c61c24b40d4", "comment": "Malware payload (Vidar)", "value": "1fbded0b8084f0562f23d4a0a2b945d66bf72c6d22564b9378245c1f15021c50e2fa84f58e7700c70b8ec3f4c0d89cdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362030, "uuid": "f9c479fc-3b7e-4356-92c2-cbc3b6139d00", "value": "T18CA6177B6260B268DD1E813AF0638F04AAF3F8BD0736C6E7478103595AC59D15D3EAE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362030, "uuid": "2319fdfa-9b34-48ee-9fb3-d12b992c7e85", "value": "2549ebf941b5f40c69593fdeea32a946", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362030, "uuid": "a33194c7-51fb-4f18-b671-0608db85fa7e", "value": "49152:pa6jgnfQVCpf+DYEuUmK1N0TqUacS1+UySCFLgpoQB5sIR6l3x96WoeopFN4XgNO:pSwUK/xaHoeojNEmPjqPkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362030, "uuid": "44312505-f402-4448-8af4-c368f7a9d098", "value": 9568768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362030, "uuid": "86e79bd8-a100-4646-a295-ce59d136774e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362030, "uuid": "a6730a14-053d-4d13-83e5-590dce100954", "value": "SecuriteInfo.com.Win64.Evo-gen.92939216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd7461c-156e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772370187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370187, "uuid": "9c0af149-27ef-4ef5-a745-54f21c701608", "comment": "Malware payload (Vidar)", "value": "ddfa503d0dba2fccd85a3c94150c0e5a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370187, "uuid": "be94ed06-bf56-46ee-a903-a0f27dba018f", "comment": "Malware payload (Vidar)", "value": "3622ba0de67630ba668b36b14907e668e03c2971cfaaea843772229857ae7455", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370187, "uuid": "e400c3d6-4e86-4abd-8661-af2b527d25ff", "comment": "Malware payload (Vidar)", "value": "497282ca89ffe5bf670ad42094f5c0caab0c2289", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370187, "uuid": "0caa9899-d709-452a-ac77-48471efdb88e", "comment": "Malware payload (Vidar)", "value": "3803392a8a849b7961213e9f428de48f260cda7785e33525a64b32d4d3a47adc4c563ee2990f9605ea5200506ccda0b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370187, "uuid": "1d14671f-c3ca-4f04-b052-c3f2c0a210d9", "value": "T1A5D56B17AEA06CA4D82E9275ECBA61927735BC5C073333D31B167D742EF26D1583AB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370187, "uuid": "dbf7afbd-9058-43eb-9656-80afe0a737ef", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370187, "uuid": "2043d054-18ad-4275-818c-4a916342b755", "value": "49152:H5Qh9qE4sfd1AaeAIODASo+DLka0c/+9VQHnF7jzm:H5ldGze9+DLka0c/r7jzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370187, "uuid": "490c243d-19bc-4bf6-8039-2a4470eb84e9", "value": 2772683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370187, "uuid": "f07fff14-5b36-4fd8-b5b7-e487c5c8d3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370187, "uuid": "f4919209-511f-42df-95c5-747a5da20058", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3878df3-1565-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1772366170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366170, "uuid": "4be22bfd-d623-40de-8b59-38470ef0330e", "comment": "Malware payload (NetSupport)", "value": "95424ea4f4659cbff105548dac4f94a2", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366170, "uuid": "3f2a9c85-cb11-40b8-b61f-15a481bd38e7", "comment": "Malware payload (NetSupport)", "value": "36650123e804721d04b9e60d381e9f0f5615b6a11e04bbfeec933b4dd1f1b83d", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366170, "uuid": "b3cd7ab6-6453-4fb1-acb9-b7ec1b2d5639", "comment": "Malware payload (NetSupport)", "value": "14c170f316bc570f016a16cde7ef1bc01b0a091d", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366170, "uuid": "f46dc58c-8be1-4f0e-8145-85262ba6fe3b", "comment": "Malware payload (NetSupport)", "value": "611c99006607d4d0614f0e8cf0bbcc505fa8a3249b58a8b39ea29b63d63350cbcf82ffcc41eb12dcec677127c2fe6a57", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366170, "uuid": "fe6a4a92-3747-402b-87c2-fd1ff3fb0ac6", "value": "T112B5F5A84E1B38C8986568D6C252B0425FA5063F6D3DC8477B613E41A22F71EDBCDB4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366170, "uuid": "4dce64eb-c4ae-4d0d-ad52-65a8d3444512", "value": "24576:OcBRoBWNB3T7DdE0vfGQlnfN608zrbM0/glarVP7xj4O2f:vRDhpX3lnLcdY0Pli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366170, "uuid": "d206aada-8c02-4b68-a38a-3399627da111", "value": 2440127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366170, "uuid": "41be8557-9765-441c-a97d-bb001a2b8ea4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366170, "uuid": "c57b496f-791d-4ebc-b697-ebbadb362ce4", "value": "n3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0381736d-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376209, "uuid": "7fc853db-aa04-4292-96bc-0f27430c0813", "comment": "Malware payload (Mirai)", "value": "b443f9381f4db0f975da86e2e9463bc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376209, "uuid": "3aab1b86-35e1-40f5-9d10-fed97bd1196c", "comment": "Malware payload (Mirai)", "value": "3787283def2912d151197b284336427025596f3acd9cd41e6271910b00f2affb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376209, "uuid": "77403601-fc0e-45d2-a953-4e85a1897342", "comment": "Malware payload (Mirai)", "value": "39da9c36aac92d8a165c099e609602c8778399ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376209, "uuid": "e229aba5-6f9f-4281-8836-5e33e6eee436", "comment": "Malware payload (Mirai)", "value": "668eb7c273f36592257904f7a3e879e633459d92bf2569484cbe09835ab3935fd7beee8fa4f2ef369fcd35375bde4fd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376209, "uuid": "efe871af-33fb-4c60-b70d-e4659f878426", "value": "T1C0F31A87F900CEBBF40BF37644A308257530FFA658A25A37725778ABAD391D41427E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376209, "uuid": "93f18119-7e82-4f7e-a16a-c239bd7dd050", "value": "3072:wUKZ5PdzJ4+iNsQ7+Dc0F4JE4aVfjbiUL/r+mfV1BBGovXyCubPL:EjPdzJ4J7+Dc9E4yL/Smf7LyCyPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376209, "uuid": "98fd3003-9693-4dbb-b218-c7dcf08c1be7", "value": 164524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376209, "uuid": "276466f0-0426-48d3-985f-ba23de1f87f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376209, "uuid": "cfffe034-b6e1-4e63-a058-133e371912dd", "value": "nm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c90b785-1542-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772351072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772351072, "uuid": "7febe31a-2dea-43d9-bdeb-453a8d05045f", "comment": "Malware payload (Mirai)", "value": "53b52a8307640fd4aa0e995673924e82", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772351072, "uuid": "29665188-235c-4f59-92ea-5dd5b3a39fb0", "comment": "Malware payload (Mirai)", "value": "38ad9d1582cf2b6c741bd87de6bd03adf21fa4ce1283587054f8aa831bd4d14a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772351072, "uuid": "404bfe73-2890-4293-ab97-1954b565871c", "comment": "Malware payload (Mirai)", "value": "666e97517cb64e14ed827c72cff3bfc9f8548eca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772351072, "uuid": "f2459fcb-9908-4b36-ab9a-7f1468ce0607", "comment": "Malware payload (Mirai)", "value": "ca424c66c709151f03ad533b799ce94f3c8396208c55594f3fdbfac9725618cab346c9b490b595ea377f8538047f1fa6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772351072, "uuid": "0903741d-9469-4704-a687-d659bfc850e4", "value": "T1A3310197501CD7128654CFD7F378800CC46DB4D564E2EF7EDCBD0E6988AE0443966B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772351072, "uuid": "2f673dc2-44fe-496f-bdd4-a97eb743f0f9", "value": "24:Dz5PgNIWZIKtGnGXFHIHzcFUPikBruuDVZny:hDGiQFUPBUuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772351072, "uuid": "a8672cc4-163c-4077-94db-8ca1defe6cc7", "value": 1693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772351072, "uuid": "e9968a6a-a668-4f19-a721-f76d81cc8df6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772351072, "uuid": "439c8485-2c44-4972-945c-02a05ece8028", "value": "cnVu.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ae2c78-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772385528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385528, "uuid": "e6466ebe-92c7-4485-b74c-063c3a7352b4", "comment": "Malware payload (Formbook)", "value": "fc4f88c4794c56f59a5268db7be65bd6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385528, "uuid": "0ebc8812-ac12-4f03-8e16-653a48623737", "comment": "Malware payload (Formbook)", "value": "392580eca380bf6cb2dcdf73ffdcd3cc7e539dbb61610623fb76683e3985fd77", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385528, "uuid": "e4e786e0-b262-411b-8fc0-52ba14996052", "comment": "Malware payload (Formbook)", "value": "d991581f40daa9746fe3863d7a14b225acc7b6ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385528, "uuid": "0cbfd81b-a95a-4d29-8c31-6260a1f2f1d1", "comment": "Malware payload (Formbook)", "value": "c9500ab284e0decc24326302f1bbdc35fd85e5d3326e1961d83ef4f472ad2c7b7926edf25fe941cd1a2a7d0e739e7e53", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385528, "uuid": "c669e29c-dc50-45b5-8d11-8eb0d73333e2", "value": "T1FC253375316481BB0A147912282873EF4D541E9BE52AEB0FE9E07DDC987B7B6710CC8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385528, "uuid": "b26eed53-2ba3-4611-aa3e-9377f34594bd", "value": "24576:/b9s/t7D9wGnZeSS1OvSOP5vaHAY3OACQB22TF3qv0aKJ:/BilJwyZWIvHP4gIOAF2Sw0ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385528, "uuid": "0a63afdc-1695-4454-b2f9-e42d755125bd", "value": 1005711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385528, "uuid": "bfe89b6c-4b16-4f8b-b1dd-650e513abc4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385528, "uuid": "4a711bba-7395-4200-90d7-b869d6f55dad", "value": "28022026_0231_25022026_DISP-1354136_20260213102352.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329f3d9e-1552-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357820, "uuid": "91313829-6cc1-452c-9923-2a88fa5316df", "comment": "Malware payload (AsyncRAT)", "value": "836dd4c48cc9faf1274dafa15c626c43", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357820, "uuid": "162575f8-3508-4683-997d-26644ac51a04", "comment": "Malware payload (AsyncRAT)", "value": "39e6cb5e8f727a509712809a775239f6c084217d1fabb1cef67a3917c645fb68", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357820, "uuid": "503b5533-d8a9-43eb-9194-f06967039ce5", "comment": "Malware payload (AsyncRAT)", "value": "d6124007f353d22c9c2c7920fc2c11194af9dc52", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357820, "uuid": "d2166548-9bd1-4b33-a652-933a47bcdda1", "comment": "Malware payload (AsyncRAT)", "value": "8e27ea49bb4d8555dfcf01a7535ec544ec5e112b2a8fa7c7411a99942c964b682718cef836dbbae84c1f1deef17ea407", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357820, "uuid": "2101df62-8419-4536-9088-71c91885e38d", "value": "T11E754B015B6005F4E6B6D7B4C5530232E6B5B9E9933193C712ADDA0C3F627A89B3EB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357820, "uuid": "fe312ea8-b355-4f39-9ea8-48fb38fd116d", "value": "85e02b8dc3af1881758d87cbf27319e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357820, "uuid": "4e097764-89b6-4fe3-8d52-15c8907e29c3", "value": "49152:sG+4eYvvvvvmmjCqOwSx/oZaxwYsCfe4:sMetxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357820, "uuid": "01b99e17-f763-4793-811b-1680a8e1cd4c", "value": 1582080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357820, "uuid": "07b1f045-e252-4861-a8f6-0a5706e13301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357820, "uuid": "43a569bb-5457-488c-ba4c-29b6da504e29", "value": "MSVCP140_1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e98fae-1517-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772332406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332406, "uuid": "b6e072e1-fd88-4d87-85c2-8cb770fe72d7", "comment": "Malware payload (Mirai)", "value": "d144b2f353a9e92405d2b9a4d0b7f70e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332406, "uuid": "b4437085-c8d6-4f77-96db-22ec79f8ade9", "comment": "Malware payload (Mirai)", "value": "3a573d04ef6b709b0874d1c802a0144954accdb1d9c98deb2c949c733b1ae449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332406, "uuid": "9ffd483f-cc4b-49ea-a508-31ee11dcb201", "comment": "Malware payload (Mirai)", "value": "2239ad9975ec8cee4766eece1e171d27b0594bb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332406, "uuid": "506cec74-df44-46b0-971c-341794559cd0", "comment": "Malware payload (Mirai)", "value": "6ca5f474aa6471d67c7c830755498b63b067b0c79f128fb83bf24866c7f7b9e4d61a374dac08927129f72ae780a78931", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332406, "uuid": "83b582a8-a028-460b-b936-bf680ca687d9", "value": "T14E432956F9809B16D5D205B9FE1E118E7313173CE3EE73129E246A74338F6A70E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332406, "uuid": "198ee182-a7ae-4a6f-a5a4-878a959b60f0", "value": "1536:DVn3MGZJ0+Ra9/zpIX/icu3/kE+YM95LYL:Z3g+Ra643/kE+YM9Bc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772332406, "uuid": "2202fb5e-f5b2-4e48-b631-4f362eac84fe", "value": 56372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772332406, "uuid": "fe6694cc-314a-41f2-9c4b-31ac1fd2939d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332406, "uuid": "44dde268-e15c-4b10-bd31-05476ea06d10", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4d2dd1-155d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772362853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362853, "uuid": "b0183ce9-c736-4ae2-bf55-a4c865cf680d", "comment": "Malware payload (AsyncRAT)", "value": "fb906e506a69225355716398a3b0913a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362853, "uuid": "ce277d47-cc79-4ce2-8660-a8f54b9f4ba4", "comment": "Malware payload (AsyncRAT)", "value": "3b3fc63c31abe00be769827bc077dae39cbb365d246fe5a2ac9a79adf964bf9c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362853, "uuid": "cffeeb71-37da-434b-9da4-a036cc83f7bf", "comment": "Malware payload (AsyncRAT)", "value": "6b34df9b912a725b6d91ebaeb4ccf7374c9312e7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362853, "uuid": "48894ab4-58a7-464f-8f3e-36faa1ae5fd5", "comment": "Malware payload (AsyncRAT)", "value": "991d4e3ecbc5c11ccef4a718ec59aaab69c14155741ca2e1a2f56a8a7c442330f4cdb64c8a92e458a50be3714a6c3753", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362853, "uuid": "ad64f471-c96d-4711-a27d-c2f4f29dea2f", "value": "T1FBE23B4877A54312C9FEAFF02DF2720A1274E11BDD13EB5E0CD48A962B679C146907EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362853, "uuid": "47b64ff2-b403-463a-b061-37a633057a85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362853, "uuid": "026aa9c7-6f28-4d72-8d14-b6ed350c6720", "value": "768:jR3ffdnmLKjvGFbO759sDFo9j9QOjhFbT:d3ffdn7j+bO759oFo9j9QOjLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362853, "uuid": "a4056474-2d93-4316-a034-d40cd67c9f08", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362853, "uuid": "8cb3710c-b339-4f41-9530-76c69cec6893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362853, "uuid": "92f43013-5ae0-45aa-a479-b493a23ecedf", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da3aec4-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357382, "uuid": "af47981f-5fb9-4728-a212-08ad26f67abd", "comment": "Malware payload (AsyncRAT)", "value": "c605d9da45b46bb32b0fb1f773c7a66d", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357382, "uuid": "60796cdb-2638-4df9-93b8-7d08f588a6d0", "comment": "Malware payload (AsyncRAT)", "value": "3bb994df9217669e0108aab5154c048daa26483192e64e22f6ec5e20ec4b4beb", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357382, "uuid": "e81b0e82-9c6e-46a1-8da1-be5b63b1f72d", "comment": "Malware payload (AsyncRAT)", "value": "34a2c4a5a40974644a277a18d291b0139bcf8442", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357382, "uuid": "8f54571b-d3bf-40c7-bdc4-da6591efe206", "comment": "Malware payload (AsyncRAT)", "value": "b6f76ecd2310eb3b23dcbfab1872e8685474ad427066a08caa40f040563c6b1dab1b98a374cd4a0f35659b6f67cd65e6", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357382, "uuid": "3261a0f7-abfb-4e8e-b025-62a4cfa2ce34", "value": "T191A53374B9242C65645C280052BE21DDB4680CFB790910AB7F9BDBC59E51743CE9FBF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357382, "uuid": "6f24d997-61ec-4283-9808-1e1c8a904187", "value": "49152:laWvfwfM1VMHhRjehRALiZfKOpmf7qPj/v5ZTA33ikOf5q+xF6abWkosUYaXa6t+:ldMOVMTWAudpmfCj/v8CVA+L6AUsU5H+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357382, "uuid": "87a412fd-c719-4d07-b466-78c900625119", "value": 2239950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357382, "uuid": "f9ecd265-8268-4b59-8add-921064f4bd8f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357382, "uuid": "71aed008-c71d-4c83-9fec-2f84d829e9ac", "value": "3bb994df9217669e0108aab5154c048daa26483192e64e22f6ec5e20ec4b4beb.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200df171-1556-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772359507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359507, "uuid": "dd74c590-ecb0-4182-9bd3-9db4696f8398", "comment": "Malware payload", "value": "4d93ea3b8e7dbcf49c67981ec26a38a4", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359507, "uuid": "2c11fd21-5aa6-4c50-8ab3-ac23e7ff6690", "comment": "Malware payload", "value": "3d3194d685ea65b6b4d08ee2bc5e8159d900315f5d405bd3230bf82902e85ec1", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359507, "uuid": "ec1275d9-fe2f-4ade-a9e3-328d1320c50e", "comment": "Malware payload", "value": "1a702cf6c0ef2202d170054bfc8158e69acff6c0", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359507, "uuid": "f8167ced-64ca-4431-bce6-71fa5424de39", "comment": "Malware payload", "value": "7a79756c2e29bdde6f82fafa575c4d09102ade86c03ce790cc74a085cf9cd2359111ee27cae9db679bf12e3bbad91408", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359507, "uuid": "53a88662-9262-4270-b819-a4b013fec664", "value": "T16EF31250129C9495CD20DBF8CAC1961AA9C75B02EB64DA1B56F0EE83B3DFC49D106DF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359507, "uuid": "d30680c6-c989-4cb3-b95d-eb4c2bd56126", "value": "3072:53IPKPm/S/h7x8ybw2SNqp/7W0p7MxygrSPmpp1HaiR8tW/kohSJBakSW6H:BIPS/h7x8ybAUpDW0p7QhmPS1dRiEkTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772359507, "uuid": "57b2e25b-0c6d-4900-b7c9-ca3f341c2ec7", "value": 162768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772359507, "uuid": "aa4a7b71-0f62-4775-a0da-6a8515c4c5cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359507, "uuid": "eb98e44d-8476-4fb3-abe8-b6f3392c784b", "value": "c61c679eec1c1b43bbd01727fdfb6a69b11485931eb8569e6b20ada30bfe84af.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef88ebd1-15b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772399369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399369, "uuid": "9630f642-5bbf-4429-9329-d6cac6feeae8", "comment": "Malware payload", "value": "7cb0860916e7e88797fce55543585d6a", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399369, "uuid": "6dbeb238-4d63-489d-86f7-4f014e2c413b", "comment": "Malware payload", "value": "3eaa5f10bffa9c089d03504cf246035247ff95780a8884716f6b229faf103cae", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399369, "uuid": "2a81a926-ca1d-4c58-aa31-14ce198db9d4", "comment": "Malware payload", "value": "58c2feab0fc5963c5f5e425124ffeef8abf4d9e7", "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399369, "uuid": "d3f4d2b1-ee7f-4ce7-b917-d0b2d97e866e", "comment": "Malware payload", "value": "4744249a94ee236bbc3ade01710bc733c2c05110b9389fdff5521c2c8ba62c4ee0b98cd97c19971f021ad0083e6af06c", "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399369, "uuid": "20108b4d-cb5c-4578-87b3-0f91de4d2379", "value": "T134F2374D9072ECB52D65C866DEE1322DB0BEF088C5F37B88AE253D3C55A4005FA715AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399369, "uuid": "50d49eb7-3ade-48bf-b036-69ff52f18c63", "value": "768:NcY7mzQ5VFNcDAFLcIwgnoYq0xFB/ytfwuv:NcKVF+D6cIwgosydv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772399369, "uuid": "7a4d99da-bd73-4afd-b333-6b6aaeb7e9f4", "value": 37425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772399369, "uuid": "99daa045-2659-4069-96a6-63d71aaa08f2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399369, "uuid": "aa7db11d-c70f-4a17-956f-825cd90060ee", "value": "pg.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d938a3ab-1511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772330182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772330182, "uuid": "558b8669-b6eb-4d9f-b8e7-b75e62c44090", "comment": "Malware payload (Mirai)", "value": "0546261d19c275d94450aa582940dbc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772330182, "uuid": "03b48f8d-e32f-4633-8856-fe5345e2d079", "comment": "Malware payload (Mirai)", "value": "3eddfd1c17d564a1db3240c7e492159925a9a1e6712882712fd8bbb91082cde4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772330182, "uuid": "b9160be7-6fc2-44ff-bba7-72c25b8b7ec8", "comment": "Malware payload (Mirai)", "value": "193cca89e8988d4acd4774d2e1193c82a4997ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772330182, "uuid": "6eae56e2-435e-4b9a-9354-cd27769ef47d", "comment": "Malware payload (Mirai)", "value": "a98412b78149a0eb5914ba484c16d4c90d957c5bf5abd8adfff65a216978a316704b00c71f711a609a0cff23cb33e9b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772330182, "uuid": "699229cc-ef53-4976-ae01-43c5924cd24c", "value": "T194C32912F98584FCC0CAC1340B6FB63AA935F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772330182, "uuid": "688b201c-3013-4347-9f0a-5b113a74c757", "value": "3072:iY83TgBMfVw+Z7cHIzO8SoMFAIRHp9hApD7bhYcPGkzQ6V8IattG4:in3TgBMfVw+Z7cHIzrSoMFAIRHp9hAJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772330182, "uuid": "a9f92756-7530-41b7-b737-1ae4a8ea6111", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772330182, "uuid": "71523fd9-0e3a-4151-9bc6-3daf559bfa3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772330182, "uuid": "82f5b803-6bf1-488d-8b57-af2f329a0205", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83382221-150b-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772327461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772327461, "uuid": "5a1ba7cc-e32f-4f19-a048-cafb9d8fb7c3", "comment": "Malware payload (njrat)", "value": "6ed909bf08d75276f27eb9b39a1bc2bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772327461, "uuid": "86a0c0fe-a353-447b-ac13-dd5adb841941", "comment": "Malware payload (njrat)", "value": "3ff05f14a134b5bc60770b15cd326719052f1c4f42bf3d6aa7bfa47116a97877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772327461, "uuid": "aa375696-ad57-4fa3-9784-25ce7a33a1fc", "comment": "Malware payload (njrat)", "value": "6072cf2500b28bc404bd5fea2f3e43cb56a8f322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772327461, "uuid": "7e368881-6d53-4fa8-bea0-d8d52cfdf5ad", "comment": "Malware payload (njrat)", "value": "46b6e3b45ed02cec76004b4a6113d079c69cb183a4730af05d4e26ffe8eba1cc49f38a376812772f47f5d9ffcc8eeea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772327461, "uuid": "7671411d-f274-4b23-806b-f890eb9c29e5", "value": "T17B25C09173F4860AE1FF1B75E4B249084BB7B9529A36DB4F0D8890ED1EB37408E117A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772327461, "uuid": "1781a1b4-6a4c-4cfb-aa26-07670cb618e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772327461, "uuid": "a3117568-170a-4788-94dc-ab243bd57c3e", "value": "24576:OXUe+xJzck+uGW/yFoBkkAQ2L14AufM5yP+J:OXUe+TYjqqanT9tMYP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772327461, "uuid": "b59d76e6-75c7-408f-94bf-b8af77d56514", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772327461, "uuid": "5554e9c6-ba5d-4bda-b898-850e1255b12d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772327461, "uuid": "8eaea778-c11c-4d5d-ae09-b9fb7e4c28a2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d32c01-15a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772394063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394063, "uuid": "40e525c5-e212-4481-b491-2b0cae3cc5f9", "comment": "Malware payload (Mirai)", "value": "6ba0b8d2503a0e520d9468a11f6dba96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394063, "uuid": "995b3cf0-f12e-4c53-9d2c-04dd9f7c968e", "comment": "Malware payload (Mirai)", "value": "404c53618abf6c72f7e0822bd67dde57b2877bd18382c44fb9ed2ee4e5c8b19f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394063, "uuid": "65965549-ddb3-407e-9b0a-14e40bbcff21", "comment": "Malware payload (Mirai)", "value": "cca75036a67eed76ec21cee460674a424c275383", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394063, "uuid": "8d8702fb-5246-41a0-a671-85c9feef406a", "comment": "Malware payload (Mirai)", "value": "05ca1479efd91f0d72d946a38f44c92829f5f7a32491ffb8db993156da3eed89c89bbf19287070e6c7885ad1aca7e988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394063, "uuid": "b21dc61d-606a-4ce6-bb8b-cf609465948a", "value": "T183D37B72CC296F58D520E9B8B130CF791B63A95191471FBE14BBD6788087D8DF60A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394063, "uuid": "81ae448a-0fb2-4184-87a7-391d25a12f78", "value": "3072:VzXmRxGBm7q2Xgtixsk6SJbIsWb17Y7oq:VXmqI7fgtiReFb1Eoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772394063, "uuid": "ed4d2ea0-8119-4e4c-83b1-e636e8c35231", "value": 142140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772394063, "uuid": "aa0d8dac-e877-4f00-bd01-7365b5901ab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394063, "uuid": "ea823c55-5394-4295-a081-86a69c7eb98e", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873624f3-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772376430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376430, "uuid": "11f69cf4-5e51-4d8a-bef5-2cf6197f4659", "comment": "Malware payload (Vidar)", "value": "2578878f4172863735895b7a737f05f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376430, "uuid": "4513bc68-4284-4bd5-a320-bf523680406c", "comment": "Malware payload (Vidar)", "value": "4127683f8121bbd4f55c3f3c72a80fca2b2095d93d3a2fd4f04b0eb91fc3cea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376430, "uuid": "57d587e5-2fd0-4f5b-b0e6-4e9e6cec6352", "comment": "Malware payload (Vidar)", "value": "f0c9110804312c7e8273feb273483f916c9ae320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376430, "uuid": "5b040878-c2f8-4374-8070-90622ec2cc58", "comment": "Malware payload (Vidar)", "value": "c6c44ee14a32308a33c35e1fdd780acea0cbd6e96a4b2de79f68be9f62d7ccc190457d85b4738d3f5ff04b44ea6f3b8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376430, "uuid": "7831beb3-5438-4d62-928d-fe14caa7f824", "value": "T136E6F7AF76A5B5E9C11D813AC062BB0194FF6CF90722C2E74ED0C3745A569D0CEFA624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376430, "uuid": "ff1b718a-6eb5-4a27-b7f5-a81d8cf03e84", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376430, "uuid": "ae68c750-28b4-4679-befc-154163dbc411", "value": "49152:nfH6uLQa7DDHSgaVxb5uBoWVCJGSVOvfz+ZyefFAkOILbvSy6fWixMGwOI/e8bB8:QfbvYfLRXJbWCnIJjJd/8+pjP+BdQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376430, "uuid": "c01442d1-6bd6-4128-acd9-6aef190fd768", "value": 14379008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376430, "uuid": "1b1cf0e3-a6e2-47dc-b830-933bcb9ae8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376430, "uuid": "55b8389b-2c89-4bc0-82b6-0dc7b71281cb", "value": "SecuriteInfo.com.Win64.Evo-gen.86574791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30281d4f-1589-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772381438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772381438, "uuid": "86113cf9-f504-4366-83d8-aba952316cbc", "comment": "Malware payload (ScarfaceStealer)", "value": "0f2fa975a1c50608d17b510b7cf873b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772381438, "uuid": "97d4fa25-13c1-4d83-8fce-0cbbb2251d4e", "comment": "Malware payload (ScarfaceStealer)", "value": "415952a85736d07c8bff35ce470b5fd3f47e83f9b27163980ca7febf3d437556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772381438, "uuid": "c2eeebcf-d711-483d-ae5e-782b576e2d94", "comment": "Malware payload (ScarfaceStealer)", "value": "5680ed74772ba8b9c25bde13ba4d0ac58868f956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772381438, "uuid": "80a2b58e-410b-43c2-9002-760bfc3e6cfc", "comment": "Malware payload (ScarfaceStealer)", "value": "9f004c4c83d1a7a84c967ccd20062b1b0afecca15a36376b64df9b3be9f5b5134f5fe56c649dd611025343ba1a0f743c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772381438, "uuid": "79212d13-9b6c-458c-86d5-c47e9166ab6e", "value": "T1B5F7594262EA04C4F9F7DA359AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772381438, "uuid": "c6a573e8-eda6-4d3c-9d98-660692551a05", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772381438, "uuid": "666ef349-3d5e-4801-8fc7-a488aea21ca0", "value": "393216:hn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:h1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772381438, "uuid": "9d6dedfd-cc13-4944-a6ba-0bc8c0ff675d", "value": 71354880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772381438, "uuid": "26f94890-8234-4a89-92e4-d81e8a1a0518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772381438, "uuid": "2ea4ac1d-64c4-435e-ad7f-05ab76b8f300", "value": "Nexora.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0829350-156c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772369198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369198, "uuid": "e0b5b314-a5c7-4311-ba2e-ed0a532fef1f", "comment": "Malware payload (Stealc)", "value": "13f6cb5126c94c91806e6c20741be950", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "nonobody123-com", "colour": "#A21140", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369198, "uuid": "8880f7dd-c41c-48a0-8bea-2c50f1c6d9ab", "comment": "Malware payload (Stealc)", "value": "415c515f3b6b35f0ab3b186bd36789594be18651452bb5d93514e888435524dd", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "nonobody123-com", "colour": "#A21140", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369198, "uuid": "d83f4e4b-5ee5-4a29-986c-521967deeed8", "comment": "Malware payload (Stealc)", "value": "857728c99f8120c2bab6c10bbd502dca9b87180f", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "nonobody123-com", "colour": "#A21140", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369198, "uuid": "b8bdf322-0b58-481b-a817-58c0ac80cdbe", "comment": "Malware payload (Stealc)", "value": "55327d0d0aaf336f74dfa38aa9de4a55754e9d52c3db45fba85c92ca677e367e0cac14aedb3566c894564594e7c14ede", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "nonobody123-com", "colour": "#A21140", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369198, "uuid": "466cdf21-7aab-4e6c-a67c-8e5d678767cb", "value": "T11C0833DFE465BE84B0A6C98548ABCB58492F4D6D48937681C36F9E7B33E4CE604610F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369198, "uuid": "40d850db-9f6c-4287-b2c7-8e8d790845b0", "value": "1572864:gnjS6dgSPxVlw4M7wXyhOrBq4R2Aa9OkMq6313LERlyHxA0kEGCm:gnDgmlw4M2DrBq4R5agBVERIRA5EGCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369198, "uuid": "5d8ba063-c976-4d85-9b37-edfd92b1b616", "value": 79527358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369198, "uuid": "a9de231e-eae3-4daf-99dc-2d8505972c89", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369198, "uuid": "4489d375-e842-4b6a-b2e7-f2df3f1b5b58", "value": "Lic\u0435nce.L\u043ead\u0435r(\u0420A$$.- 2025).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231db7e0-1552-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357794, "uuid": "892fcb4f-8a11-44cd-9d1a-d86fee854e00", "comment": "Malware payload", "value": "e9cd000f07d7d15562390e6984dc419e", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357794, "uuid": "2e545533-67e3-4c2b-a3b6-ee2a75632b07", "comment": "Malware payload", "value": "4191060ffc195eee4db291e87ee196036fce15f171250977b30d777e24fe3a7d", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357794, "uuid": "c03a4110-07ea-47af-9fa8-16b64085f75b", "comment": "Malware payload", "value": "b73a52cf3cf5657fb2008e877b0fc38a893ad474", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357794, "uuid": "586cba7c-ef71-4cee-8f81-40845c13633b", "comment": "Malware payload", "value": "3d99e466851cdeba45a0042123531d511b01e562d96149c7d8822b950972a429d555b98209b32e361e6ec594ac4525bd", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357794, "uuid": "04c8c777-72af-4094-a211-1bb3ba52dc7a", "value": "T16D15337FA12DA09FB94DDA742960842FC0DB64307F9C5095D453AA437B0093FB79EEA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357794, "uuid": "1a83330f-cbe6-4852-b2e2-52f1a143d4ce", "value": "24576:7y5AxYkmIFQaIuO0QFaWwhv53yYc7rVPdoJSo:72WYkP+OyaW4BCYc7ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357794, "uuid": "80ce23f4-60dd-4b2b-b2a9-53e3634834e4", "value": 883410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357794, "uuid": "e946b93b-806d-40fd-b8c0-5d694d22555a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357794, "uuid": "72d016e2-560d-41a9-a7c6-a36ce4bd8aaa", "value": "WINMM_core.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a506d2b-151b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772334211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334211, "uuid": "3f3e4ce9-d1db-428a-b76d-4971bc507b6a", "comment": "Malware payload", "value": "6c9a6f3f7a393d7ef0afcba43ffaf257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334211, "uuid": "c561216e-9039-42e0-99d2-4868ecfc9428", "comment": "Malware payload", "value": "41d25d3154a8e304d84312b49310ddf914339c5410c60c63d6ea8ebcd007b1b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334211, "uuid": "4953e8c6-2bc3-4dbd-81e9-ad5e90801429", "comment": "Malware payload", "value": "8af9754ca8da85a31937c801693567c2e98808d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334211, "uuid": "be0982ff-ba52-47ff-8292-566f25da749b", "comment": "Malware payload", "value": "821b4a5c94942d69fc0aa0a5e4fd5d5c4ef3aac40a359380ead28aea2fb283395dc2d843ae92b95f7ccf65860a56bf54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334211, "uuid": "94da4f46-c2a3-4a5c-a65b-1febbe6b2d7c", "value": "T161132891B9819A0BC5D106B2FB4E418D77166728E3EF3302DA295F6137CFA960E3B944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334211, "uuid": "07f17546-6c59-461c-a345-31eaec884fcd", "value": "768:IlP/bstM3aL8IKF5Uk3pxso0eultMMSwVsn78GGIGVsjKAvqI:qPP3adKZDFMm78Gq6Pvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772334211, "uuid": "b93824f9-b12b-4ace-8852-8b8cc60822f3", "value": 44036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772334211, "uuid": "813400ef-14ff-4008-967e-41a80dc05488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334211, "uuid": "7dedf037-e135-4138-bcab-14b1ab76a33d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ec494b-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376212, "uuid": "784c56fe-30de-4a92-9714-72c347852795", "comment": "Malware payload (Mirai)", "value": "5b12a1f94a8ce17635ce112433649274", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376212, "uuid": "4b6321cf-ceaf-46b1-9b7a-7e2f3f354a7d", "comment": "Malware payload (Mirai)", "value": "43d6401f53bcd6640e3594b223094a7154339a6b5efaf97e8bfa29ad94e8fc19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376212, "uuid": "b82e967b-f834-4f2d-b6f5-10f4bde2d8d7", "comment": "Malware payload (Mirai)", "value": "aadc954df68c3941b45f5c2bd5e085a9b849755b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376212, "uuid": "3700cf06-f45f-4bc9-8920-c7fe6cf2933a", "comment": "Malware payload (Mirai)", "value": "4035daea70d6c3772cdd2d56933c919ed859073c9bff1002d313f52a801cae2790a6c07694ca73ef4d34b60d1f2e27f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376212, "uuid": "c6aa2c05-8215-49ce-9525-9fb980efcc5b", "value": "T1A2F3F906A9919F12D1C311BAFF5E514A37133F78D3EE72029C246F60778A8EB0E76616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376212, "uuid": "4baa9896-023a-4136-bf6a-741e89f242bf", "value": "3072:mAlcLaJf0TinE05yxhc0XFKyq3XfLU2CuQwNyaL/T6uezK/:mAlQaJf0EJ5yxlXCXfNCuQwNyajzezK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376212, "uuid": "c7b71880-8816-43d5-bc05-0430a0646529", "value": 157776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376212, "uuid": "e675a15c-eff7-4493-9c14-6645d86034d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376212, "uuid": "93494461-d5d2-4a03-a034-1b833f35db5f", "value": "narm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d605ac-1556-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772359515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359515, "uuid": "b990414d-abbb-4522-806b-74e1d06f5b17", "comment": "Malware payload", "value": "1a66fb65e83f87a414675e7cc273f250", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359515, "uuid": "960ce875-3096-4bd7-9ff9-2fe5eac6844c", "comment": "Malware payload", "value": "444dcc100a24af85a3efc4f4c590de843018ddf6dc4a06ca8dad31e594e05807", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359515, "uuid": "3b35238b-d2ec-46f9-ad91-73527384e1be", "comment": "Malware payload", "value": "c42a8ad2c1868a14871f09dd35cc41784fb459f6", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359515, "uuid": "ae7ccd3f-de51-4f07-b046-d00752c409c7", "comment": "Malware payload", "value": "ab2587553e62b1de98bc63ec7160b5d9d702118c9e8bfa4a29632245c40ad8a04ca8397c55f6b6e0038210a846b7659c", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359515, "uuid": "163fed93-c89f-4f61-b7fb-34011bc66f4a", "value": "T1667533C7C1A216C5E41748BD3F712F3484B8A4F3C03A8AE5B54E5E5A7E9CAE218560DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359515, "uuid": "74c25a85-883d-4bcb-9f1f-eef6394fff74", "value": "24576:Xj2/4mdy7ZxqcrOX5oCdOUhUiw7gJyWYgE0rLGaoBbI26vfPvd3+UmGk6CuSeMBp:Xj2nQ7ZxqcrULdiT7HOVLGPf6PvdBTkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772359515, "uuid": "f5e2ff4c-9bdf-4db7-ac8b-aabf114a40ac", "value": 1561079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772359515, "uuid": "bd70a483-c7dc-486f-83a1-49afc1d5df58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359515, "uuid": "272d30ba-6f07-47b1-956d-0796a19a91d8", "value": "a8b8a92d170029885d4e7763675f10eb172150f8503592677cadedc392edccf4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae47c2cd-1515-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772331828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772331828, "uuid": "0a9cf52c-946a-414a-b1f9-fb540b449496", "comment": "Malware payload (Mirai)", "value": "b02a3a4232f949de89a6107860b6f5e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772331828, "uuid": "0702867a-a0c5-4a6e-9d15-9981bccd19a6", "comment": "Malware payload (Mirai)", "value": "448d10cc0e0652674d8eafc37a3fba3937114fc3d2c2fef7aca659b43cf182af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772331828, "uuid": "a02312d7-626e-4a36-a12a-2966d351c11a", "comment": "Malware payload (Mirai)", "value": "ed76866c7dc211a2f8a6781e2f5c3a2f3d24a9d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772331828, "uuid": "1dd12658-2cb3-416d-a5ff-f6699ec6cfbd", "comment": "Malware payload (Mirai)", "value": "687e2ad4909fa57f5ef497d2753be40e3c71c7164824d9dea350a265cb61b3a15126f9b4e8c9837d0c5ca3e370bf3371", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772331828, "uuid": "13df32e7-5650-4edb-b4a3-b14e2acea3fe", "value": "T176F3C50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772331828, "uuid": "5d397faa-a9bf-43ba-9f77-23668669f025", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwF:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772331828, "uuid": "bd356694-2a29-4f69-b4d4-c94faaae061b", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772331828, "uuid": "72fee0bd-0848-4db1-b204-b168d67e940b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772331828, "uuid": "67f91d14-9dc3-4940-ac00-0f2a04bffced", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e2020e-1569-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1772367868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367868, "uuid": "cf081fae-d779-4875-b032-4ed50a328805", "comment": "Malware payload (Efimer)", "value": "f2b7c2749b9c53f4b3d48d9ca0922bc3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367868, "uuid": "03019830-3336-457c-ad2e-3f0fd7fafd24", "comment": "Malware payload (Efimer)", "value": "45e22850f99f1fb374587c1655ac2628ff8cc198bcc2b2ece62b75e22895b23b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367868, "uuid": "3c62132f-f8c1-4f93-8f54-44cab48b6681", "comment": "Malware payload (Efimer)", "value": "073d770af6e50f89cb44cf7e406746b45f26ce1d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367868, "uuid": "2e077438-d78b-4a95-b2ea-c8e73ba5634d", "comment": "Malware payload (Efimer)", "value": "0f8171fa078de3bfd1e8859c479d1a21df86bd5bc00238f1566b46b9dbfdb8f352a8ce66a6892eb87a54ae1ea26071b1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367868, "uuid": "f5c84a22-4896-4d1a-8ac7-fa55b799757b", "value": "T144D6332C94C630DDCBB7C1B8BFD26AB1B4A8B4764371AD3A9328D3727C5359059B904B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367868, "uuid": "674efe3a-4f2f-48a8-8769-cfe26b69a7bb", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367868, "uuid": "e049c49c-be64-4880-ad31-7fcc34b2e3f0", "value": "393216:0NXX2q2eItflwlQ/vSMsyuFXMCHWUjX9cuI3/PGTAI:0h2jt9CyuFXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367868, "uuid": "1b5c6a7a-fbce-4004-81af-909951d32309", "value": 12622269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367868, "uuid": "5335aebd-c563-470b-a0ea-e3720d7532ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367868, "uuid": "37f69d17-f538-405d-9a1e-d49bbf34c289", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce20ba4-157a-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772375286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375286, "uuid": "20ef8b79-6cf7-4b40-bc9c-06b33311f8a0", "comment": "Malware payload (Smoke Loader)", "value": "cc8bb60a18ffee2af8fecda49923f803", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375286, "uuid": "7fcf6647-3d76-4bbd-9bde-096b127c6d40", "comment": "Malware payload (Smoke Loader)", "value": "46145eb01bb32c28d3550b307891336d531c3e5c4e2b6656f3d19f751cb4408d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375286, "uuid": "79b688d0-218e-4b1f-9011-495bf1dfec1c", "comment": "Malware payload (Smoke Loader)", "value": "d3cb03f464973620fd606b77c5861121070b4409", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375286, "uuid": "4f150082-dedf-4082-a42b-d1770de8d7d7", "comment": "Malware payload (Smoke Loader)", "value": "0c4f093ad6f883fd23400c374b460a5f1a089fdc14576f394e82a981ec20830ead638152bb79e63d4398e419458a649b", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375286, "uuid": "a16eb33a-ec6b-46d8-84e6-a7b2e2f67c0b", "value": "T1C295590F7DE458E6D46E9372C8BA11927734BC590B3263D31F507A782E72AE19D39B08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375286, "uuid": "0fe2da8a-da04-423d-b850-0acf1c01b2de", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375286, "uuid": "a2361601-d8a5-4ae3-92de-451f5677d1b8", "value": "24576:ibVK+NrguDWJHZ9dpHQIc9aoNkufsg1X0BRUrtP392EI:ibVfNrguDWJHZ9wIcN6ywRUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772375286, "uuid": "a813a270-fa47-4872-8b21-8800c0608ab2", "value": 2003456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772375286, "uuid": "537ee5db-40ee-4397-9d5a-11f67da9d350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375286, "uuid": "e3d97975-2fcd-4ccf-91d0-9656a4d68332", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcce700-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357627, "uuid": "d6ec4112-8118-4b89-9c4d-4535e36493c9", "comment": "Malware payload (AsyncRAT)", "value": "58a6e9320e979b834785bec26a99b397", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357627, "uuid": "318b05c9-224e-4b27-8eee-664002b69ab4", "comment": "Malware payload (AsyncRAT)", "value": "461d88a1ce712cc260c0b32a6088a16bd6ec6401478048b466f979480640455a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357627, "uuid": "a1917c15-64c6-4704-8b11-54e48ca94072", "comment": "Malware payload (AsyncRAT)", "value": "8cbcc48db255ed4ac37513613b2d89ecb9a59493", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357627, "uuid": "cb64d51b-da9b-4ab1-ad87-5b24c28e116c", "comment": "Malware payload (AsyncRAT)", "value": "4d207699cb742accea27397c54f2fdf2efc0cb0f54d78febfc1ad15e619cc437db729e923c18c113af2106a647d7b4a8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357627, "uuid": "3530282b-6334-4ef2-870a-199532db66c4", "value": "T176F24A0473E58665E1FD0BBD5C3686044372EA474D62DBAE2EC450EE2A237C8CF14BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357627, "uuid": "e2822d62-4f70-4bc9-9fa9-bc62089c31d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357627, "uuid": "6fe80d1f-2a64-45b1-bf5d-4dbd5e0931b8", "value": "384:dMTh22Q1RzOtaf0hOlE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCvqWWZEQ+:dih2rbzOta8hx1hV4RbJwB+WW3+Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357627, "uuid": "f4c6d70a-6fcd-42c6-b9f3-1996366aa5d8", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357627, "uuid": "7ed1b7a2-f556-4ea6-a8d1-299ef78b1354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357627, "uuid": "e6be126e-5596-4c4c-8259-6a3a5dc201cb", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3532f856-1550-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356965, "uuid": "267cbf1f-1c07-4bd2-95f2-5c8d6cf53ca3", "comment": "Malware payload", "value": "4e5b1154fd7c803f318f610488e446b1", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356965, "uuid": "ecfb07f3-874e-4cd0-a745-e8488d4def0b", "comment": "Malware payload", "value": "4650c88b800abe2426b859107c4dbee8199aa1eba2fa71781070e849aa133bf7", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356965, "uuid": "d1eb7f92-ef7c-49b4-9ed9-3dc8c97b5684", "comment": "Malware payload", "value": "c016108d0bcd5bbbd2edded0a89f79d00eb3563a", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356965, "uuid": "551e07ba-3cd1-4c53-9d34-8bfe811f8d95", "comment": "Malware payload", "value": "69729c8b6c857df31e4c7930957be1729075c28150ec4e396a1ce68c409c9b0458f44182eb28f24e7bc2e33ad50c8eb6", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356965, "uuid": "fd6c5164-7192-4b51-98e4-198d81fd39a9", "value": "T1AAD0232D9656D25FD033F6F36D11BE51D00DD640010D06CEA104718C274D5B159475DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356965, "uuid": "c05bf698-fae4-4657-8f8e-29dc14e29a00", "value": "6:5jajM6UbynoyKMECJIxUpsOS8va9dOajMIt5EtUb9mt+lh:5jOM6LoxFoISe9sydHMIKHtah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356965, "uuid": "a58e9748-3f07-4a35-82bc-1fb32d9dc9cc", "value": 245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356965, "uuid": "6f653704-436e-4a3c-ac4b-97a1ec1d7972", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356965, "uuid": "3b5b974d-2398-40e2-925a-fa48107e036c", "value": "Fac_2026_5984951219.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbee3808-157c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376197, "uuid": "3a05666b-aba6-4407-80be-2e9ff714ab65", "comment": "Malware payload (Mirai)", "value": "ba355120627cf985eab29d67c8d7108c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376197, "uuid": "a2ac52e8-42b4-4869-81d0-ea3b21aff222", "comment": "Malware payload (Mirai)", "value": "46937002aa9b7dda939f7c1bd8aae78764349b9b2e49598859bfee57a9938afe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376197, "uuid": "4115a741-4194-4194-b796-2ea09cc67693", "comment": "Malware payload (Mirai)", "value": "14493e834b75a7740409d924c30cfc03904ba235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376197, "uuid": "f207ebdc-d22f-438c-96ec-323fbdfde7f5", "comment": "Malware payload (Mirai)", "value": "f49b23f66158fa649c72369745bf26aad7ac438b4280bfd213f5ac44ccdc768a739a61eac2b9d5bc85ff234c04bd98ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376197, "uuid": "fd96ff68-ffc7-443e-af2a-8b8aa3e26f2a", "value": "T1A8830946F9819F05D1D622BAFB9F514933136FB8E3FA7101DD206F50238A99B0F76912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376197, "uuid": "c22661bb-fc5c-4e9a-9627-832b0debf3e5", "value": "1536:vUnoalp3oimt+HRJtjOMeHqx/yx3M8CK1B97xsqjOl1yHpRiY1Pk5fm:Nalp3oNt+RvjOoxyx3M8CK1B9VFn1Pk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376197, "uuid": "a6ff3b7f-86db-4ff4-9593-3209ea1bff77", "value": 82436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376197, "uuid": "dd45128f-6494-46f3-b36c-c52a8aa3bee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376197, "uuid": "d899048d-0040-4809-8a80-62e0eaaded35", "value": "narm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7988b8-15af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772397917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397917, "uuid": "a035861a-991a-4381-a8bf-7807f0266fb8", "comment": "Malware payload (Mirai)", "value": "b5649b1bd73139c2987759bc2da1f5d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397917, "uuid": "f7c45d5c-537d-47df-bc1e-543d3e5701a3", "comment": "Malware payload (Mirai)", "value": "46dc2f4b0bf67a41a3f5939e78b89e321311364acc3ea36f1fccd695f7504386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397917, "uuid": "a6982b8e-65cf-4caa-9a83-0a44b291ddab", "comment": "Malware payload (Mirai)", "value": "e6f9a3711faf08f6366d6b009fe7f74306a48392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397917, "uuid": "d7f1af9a-fbd3-4f23-b194-206f6c830dff", "comment": "Malware payload (Mirai)", "value": "08d6cdba61b15b9a7a5731fbb4c1eca5353a488cd060927502c56622eea5b3762e227b30ca3d4f22e5019ee3f8f98c89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397917, "uuid": "844f9ee6-64cf-45fa-b244-a51f43264728", "value": "T1BB14851E6E328F7DF268C73447B74A34A75D62D627E1DA84D1ACC1051F6028E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397917, "uuid": "eeb1807d-776c-404b-b5e5-589d20736527", "value": "3072:GB6yIDRVQt8rjYNZ7EsTZM9bpQx/vGjJuW8OItvACDamQam:GB6jb3jY3rdogv4Gtv17Qam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772397917, "uuid": "8b535d06-6f3a-4bd0-9da8-8af7859ab837", "value": 208848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772397917, "uuid": "801f73b6-8688-47ad-a298-151672f009ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397917, "uuid": "39c61088-ea47-44ad-b6a3-634b37bd32b8", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee28eab3-15b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772399366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399366, "uuid": "99cde745-7924-440c-aa2d-6cf1b6736eaa", "comment": "Malware payload (Mirai)", "value": "fb966de3b2d3f8f1b0179dc1e5b3888a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399366, "uuid": "709a3af0-5d6d-4feb-b76d-a3c26d7fd2ce", "comment": "Malware payload (Mirai)", "value": "4776b0c4a847fca9526f7459f2f5f5736c64e890863888787d7c569c4f997c5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399366, "uuid": "e965476b-da43-471b-b05a-48a6175482f5", "comment": "Malware payload (Mirai)", "value": "99c6bd39ed4514dee89ddf891abc6d5eeacbad10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399366, "uuid": "ba6285fa-9490-49ec-821b-ddf01cc8be21", "comment": "Malware payload (Mirai)", "value": "aeebf37ae7e5f08b2056128885b064736d70540c89caa536de82f7028913f9a1190d5433d750f01b39eb3e311ba30229", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399366, "uuid": "915ffcb0-c2a3-473e-88ca-880df521d9aa", "value": "T1E8B32902B71D0F43D1632CF02B7B1BE0979AFE9118B9B5C0611EFAC552759F62286EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399366, "uuid": "ee73856d-1b08-42aa-92c8-e25de34ebc86", "value": "1536:OdIPsTZi74XGhgjLlf/7VbQS9GVov8WKkJO+5yB4kQlW6kuTOk+dAXG6Odpf0kh:O6GCkLtvv8WQpCFW6rToxnLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772399366, "uuid": "c5c1c802-bb45-4fab-a725-c251cba1caf9", "value": 117524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772399366, "uuid": "c27ce9eb-5b50-4f67-a5b6-22c0bf5ae583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399366, "uuid": "ae5673a1-9e8b-47f7-9c3e-6c51f5280927", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6275b65-1568-11f1-a769-42010a9c0008", "comment": "Malware payload (pure)", "timestamp": 1772367463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367463, "uuid": "7a22a7e1-e48d-491d-8cd9-adbcc2cd6b53", "comment": "Malware payload (pure)", "value": "311f2c70d74c92ebb8b694046f5332c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pure", "colour": "#6BF859", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367463, "uuid": "799eba48-c5a3-48c4-80c8-3d42c34e40cf", "comment": "Malware payload (pure)", "value": "4a8751808fdf81e5819fd4c299bf1dd09547c938f63721e3820623bd8771a6cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pure", "colour": "#6BF859", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367463, "uuid": "990d9bd3-634a-4824-b003-38ca5c9ea4dc", "comment": "Malware payload (pure)", "value": "be57aa28fd97ae988e6f225b44d40b7e8e48c32c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pure", "colour": "#6BF859", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367463, "uuid": "c0b2624d-1703-4c54-b346-21f09d0d7f99", "comment": "Malware payload (pure)", "value": "d343f85f63141de86b401b93f60c4b0e67f37d7737013b476113b8e6214aeb9342a613abb7571ac07b4c3a8e0fa70de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pure", "colour": "#6BF859", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367463, "uuid": "64efbb73-da97-4bab-a536-af0fe793da11", "value": "T1E0E633AA7626E473CC772A7A6996D633C748FC07A1F3513C7F24F652903241AB4F5A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367463, "uuid": "1db3e69c-43e9-45a8-8180-e4c9a39874a8", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367463, "uuid": "d5946bea-f537-40af-93e3-962b1e759073", "value": "196608:LVMh8BzDH03Ke6hV6As2EbMfFqu+5F/6ieVnibzczcGcezKey2nnFOEbdjVFKF11:+iDH0Ws6gu+iiIiXczDzKeJVVkUqSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367463, "uuid": "fe330128-653d-42aa-89fa-a58b4199f0de", "value": 14627840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367463, "uuid": "954faa49-4276-49fa-8647-17d4328b98d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367463, "uuid": "b8e34e96-6693-4f01-8725-aed258b484ac", "value": "Installer_v2173_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b4aa4d-1556-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772359495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359495, "uuid": "fdcc35aa-e1f6-4bfe-9eb3-d89a6688bb4e", "comment": "Malware payload", "value": "8d32874acd219bfb1f8a329f13067a51", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359495, "uuid": "31b7b8ce-25fa-44c6-bb47-643ca7c9c8d9", "comment": "Malware payload", "value": "4aab7542b1e4f4f338da39b678fcc8f33d435b000526fc705e7b76091705477e", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359495, "uuid": "bbd89767-ad07-41a4-9035-157efe8d726a", "comment": "Malware payload", "value": "38f6b3ddbbadd6b9a95339285aabfecda6b220c1", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359495, "uuid": "2a26c84d-58e6-4ebe-a7cd-205cf34ceba2", "comment": "Malware payload", "value": "1ca034f1fbd85f9997d5d49bb5fbcaa5286e6d75872a141811b97c16674e8d2b0f3e6a6af0531a6ed7ceb972e38613ff", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359495, "uuid": "147e70c2-6fc7-40b4-9b78-862b08d27251", "value": "T158249E22B980D472D072043419F9EBB6697DB9314BB589DBB3D8073E1D301E17B36A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359495, "uuid": "8cc34eaa-3d23-4a0a-932d-daff8553ecf4", "value": "467f5c2d42285372948d9696225cfce2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359495, "uuid": "8e07a91c-041c-468d-b383-1cef60cf316f", "value": "3072:B8EDWqXJg+0TxmRHvh7arI4CSNmnJi5vwS0GY6ERSoRj3dPUEeJfAtJQUe8h:BfDWqXt8xmRZ/4CSmJi5s06QUe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772359495, "uuid": "397606ce-a3cb-4036-84c9-7b4bca0a4371", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772359495, "uuid": "5e136364-be60-4216-b7aa-a3e7107dcc0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359495, "uuid": "c91c5cf5-6760-4610-9830-9241ab0a5cdd", "value": "4aab7542b1e4f4f338da39b678fcc8f33d435b000526fc705e7b76091705477e(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb1a43f-155e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772363070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772363070, "uuid": "f1a46d31-f6ff-4b26-975c-b354d43b5755", "comment": "Malware payload (AsyncRAT)", "value": "b178f92f5ec0825c4a36c8dd4dbabf3a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772363070, "uuid": "52c302e7-a213-4cb1-aded-f438e4193d2c", "comment": "Malware payload (AsyncRAT)", "value": "4cb56da30f18bc7f25e2fb1b3783b125b6cc8f6eeadb40427ff7fda6a6a1e5b4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772363070, "uuid": "b0b480ea-2be1-4997-bd79-cff619a21f02", "comment": "Malware payload (AsyncRAT)", "value": "e0a39ff3465f5d891da5c14aeb4058ec2965015f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772363070, "uuid": "636d446f-f109-4921-957e-675842adf156", "comment": "Malware payload (AsyncRAT)", "value": "636781049e884c7614b55b35b8497bff99d2c0f62fec723cacd50f4e78711d263189b0376650881c992ee9b0ac657cf6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772363070, "uuid": "53a296e1-4d21-42c3-ace6-6078960eba9f", "value": "T154334B4C7BE44526E0FE9FF01DF26226973AE2435912E64F68EC01DA2723BCCC9156E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772363070, "uuid": "9f7d083a-d217-4407-95ba-1dca42d58a4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772363070, "uuid": "120862f1-f266-45df-ae66-b7102fd11285", "value": "768:n9JiAt7ZBRK9NcGrA5WiWve2+bFyfKn7EVX0HD6nCOthcM0npKzn:uw7DR4cLO+bFyfK4VuD6COtt0nQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772363070, "uuid": "ddb39f51-c034-4972-b233-e0cfc5a51812", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772363070, "uuid": "16b4afe4-402c-43b6-8fa6-2c55ec1ed03d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772363070, "uuid": "f450390c-ce6d-4304-9ed4-5cd9cf2c47a1", "value": "imgay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639f846c-158c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772382813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382813, "uuid": "ea7bfdc8-2136-43c8-b046-7d41f3e2f470", "comment": "Malware payload", "value": "b7226d0ed1acfc1830e300948cdf432d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382813, "uuid": "da8d3b1d-c377-46d0-b19d-d6cf5e1cad25", "comment": "Malware payload", "value": "4cf46903b22a7c767238431d7bebf8109a3ee11e2be9aa6c2f72500a34075661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382813, "uuid": "25fad3ef-67c4-4e02-a790-09d29358c3ad", "comment": "Malware payload", "value": "dfffa18c5d8af0388f85c6aa63dfe4c6de65f7ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382813, "uuid": "8fee63d9-9619-457c-9b5c-26c343d28f2d", "comment": "Malware payload", "value": "5d8ed0a6f22e891984594c537951e1a94b7c91e8dee3250cfac43548ea99b9af91e34ec510f9da25ad1b86bb1ade493f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382813, "uuid": "4c238ac0-114b-4734-b40d-4ad212c5f5e3", "value": "T17166900CFD92F809DE2A3DB7CFE510045FB125C1AE1284562119AFFD97AA3B255E263C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382813, "uuid": "82d40021-9972-48a8-857f-fac0d5ca0f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382813, "uuid": "22c3a150-c3dd-4788-8d11-835d98dcfeb2", "value": "49152:r3PGFjJHufIZ2mca4klgbzxuL+47noG1tIJUbChvv7nwYVetiV3RFCx7Hitu3AeI:r3uFjTuxxtEoaCJVhT0scEuQpA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772382813, "uuid": "5fb636f6-7b1f-4ff0-9b15-a6cbf38fdece", "value": 6502400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772382813, "uuid": "e5a69df7-f54e-4f0f-ba64-1cfa27c86403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382813, "uuid": "6ae2ac91-4290-473e-9866-74e60de42991", "value": "Nursultan_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76bd9d0-155c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772362311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362311, "uuid": "863bb139-322b-4ba8-af89-fe8ff87bc59c", "comment": "Malware payload (AsyncRAT)", "value": "00799ea198766197d5f645c90b368bb9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362311, "uuid": "a8f1dfc0-d643-437a-aca9-14e03e014a6f", "comment": "Malware payload (AsyncRAT)", "value": "4d5bd2d8e6125cae5bf017a0bd0375291975ceb4c0d55e87994a27ed72eb62a1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362311, "uuid": "59b65577-c394-404c-936f-20ee59921f0b", "comment": "Malware payload (AsyncRAT)", "value": "bc73b5e5103f45e5adb8672064de71b921bdb258", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362311, "uuid": "6c9ce6a6-9961-42ce-83ab-c91259891e57", "comment": "Malware payload (AsyncRAT)", "value": "afc4b01a66385925d6c9018af5568a3f251e5503c4486a03cdf6d74af7e47ef4c9fc2a7ebbf5bcffd0619903d19e35fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362311, "uuid": "199d70b7-6f39-49f0-a7a2-e7ae374126b0", "value": "T1F12186059CD402F3ECE13A35BF5A222AC8CF8F5536849E0E15CA055C2987C1C2C3BDAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362311, "uuid": "87c53c50-18a5-4540-b902-c5d321c6def7", "value": "24:9dToOr1ET8/5G3sWAS6qBF223hj3xLqIMRPKFP3zewng76GNSXKTYz:9aSPE3sWASV22xMhRPKF5ClNYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362311, "uuid": "3dc66575-f61c-4dcc-8ffa-c9a9cd6d99f4", "value": 1128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362311, "uuid": "b3fa1d90-62b1-4e3b-9f9c-9dfd35c36916", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362311, "uuid": "b425de44-8e20-48cc-b1fd-af1e65cb58e2", "value": "64thServices v24.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a06617c-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357376, "uuid": "69adabab-87a3-418d-b115-34e581cff0ec", "comment": "Malware payload (AsyncRAT)", "value": "22cb7be481ea21a2d28f814d3b4688da", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357376, "uuid": "344a4167-d934-4b20-93ac-72af8ddfef2f", "comment": "Malware payload (AsyncRAT)", "value": "5050220cfa47aabeba07ca7324abd3d161068d62f1ccc42d2aad5a46c237a4c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357376, "uuid": "f0532061-b3aa-423c-b7f2-e379e846b654", "comment": "Malware payload (AsyncRAT)", "value": "c2d7b9b6014af22d17f123205efb264b1634a84c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357376, "uuid": "8d9fa206-acc7-4598-99be-1586692d4e17", "comment": "Malware payload (AsyncRAT)", "value": "a06a4e307eef378bcd642e8e14cf0fdd895dd2447fb4eb1c9b70add7dcb864512a3af479aa2f3f5e993b2c1f8ec4f919", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357376, "uuid": "de8d9163-b44a-4af7-8217-58db5e1125bd", "value": "T1D2F24A0573E58665E1FD1BBD5C3686044372FA478D22D7AE2EC450AE2A237C8CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357376, "uuid": "1d18005e-34be-478f-bca4-3c59c94de66f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357376, "uuid": "00953ef5-3c20-46e2-9f36-f943760e5b2a", "value": "384:bMT5XY+17Ng15KhElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfC1/WWqEQ+:bi5XHRNg1IhT1hV4RbJwB+WWclQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357376, "uuid": "0538d6ec-b969-482f-9220-ef5142ab8a46", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357376, "uuid": "c7483b3e-d4e7-496c-898a-e0a0ea507efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357376, "uuid": "f41381da-a60c-48f2-a6ba-2b1a1f3d4817", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b674a254-156c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772369208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369208, "uuid": "74198d62-af53-43a7-804e-3e2e11f324b4", "comment": "Malware payload (AsyncRAT)", "value": "797c8211269e8073a3e5dfb87925be1b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369208, "uuid": "4dcedcca-4d54-4b93-818d-e270a07bd0a3", "comment": "Malware payload (AsyncRAT)", "value": "51244549137415d7f7c51d87cf6b185ee83cbec8bef9ac24656c1b3d3b871b59", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369208, "uuid": "f77b2b7a-1438-45e6-90be-abb649a004a4", "comment": "Malware payload (AsyncRAT)", "value": "61629656720bef92d460a0a55c1339b2802b5d86", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369208, "uuid": "0d56f4cf-c896-4d6a-8557-b459e5ecb1ad", "comment": "Malware payload (AsyncRAT)", "value": "de9766272a76f6c8cb28adf63480cada96e2e6eaa443ab243b6bc4b5e121947833a2a7215a8cfc2c9255926f06cfa0d2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369208, "uuid": "7373c6ab-fcba-4176-bcc8-f2dd921a6624", "value": "T186F24B0573E58665E1FD0BBD5C3686044372FA478D22DBAE2EC450AE2A237C8CF15BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369208, "uuid": "20c8c5ea-e49d-4f81-bedb-bdebc8be3494", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369208, "uuid": "85630796-3624-40cc-a904-019781cd39fc", "value": "384:WMTh/ik19HKliohulE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCQ0WWHEQ+:Wih/r3HKlJhR1hV4RbJwB+WWW8Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369208, "uuid": "692f3e45-07af-4fc2-9807-edcbedf372b6", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369208, "uuid": "1b0413fe-1be2-411c-91a3-1e1104aa5f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369208, "uuid": "72c5c870-d2c4-4d8c-82b7-6f15d1476380", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c158f962-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772385547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385547, "uuid": "a0cbe35a-be69-4fde-acdd-d996f8701363", "comment": "Malware payload (SalatStealer)", "value": "049013405eba778a5cebc0ce034a9542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385547, "uuid": "ed3a4343-3b98-4587-9275-f15472b65a9f", "comment": "Malware payload (SalatStealer)", "value": "5491b9df2bbd46a5c1a8dc0a233bbd40cf26a522d925db56522c0167844783d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385547, "uuid": "56fdfdf6-f607-4639-9208-f8e98b5b0e63", "comment": "Malware payload (SalatStealer)", "value": "0d25e9916576e50ebc061240c91805cdaf2731de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385547, "uuid": "6e328d44-7dc6-4d8a-99c8-fb8be973f8fa", "comment": "Malware payload (SalatStealer)", "value": "ed20fc6758081dc56e4cc5c40e78571c027a7dc3b3adfb4246f9474caed3fa334134d4792262a197fde3ad7238708412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385547, "uuid": "4e82d495-1901-42bc-abbc-ac483d932065", "value": "T181E5334982D585D8F19E72BB2E33641D9C8AC523A99B6203E01F167966C1A7F70C3FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385547, "uuid": "0ef088c7-0a1f-4f8f-a83d-81e048a68107", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385547, "uuid": "597d1f2d-3f7d-4697-a8fb-c54f61078efd", "value": "49152:LLSbImVCdCQXqjTyDtuj6XIqocljpsXo1vpfOJEeNP5qnb7Fxq8E7DvYDiqoTeF+:6DCdCQXqqeqocpR1v2Y/Fxe7aoTAHV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385547, "uuid": "417e404f-5887-49cd-ad18-f7c416358861", "value": 3296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385547, "uuid": "6d4cbc58-b9c3-42b9-bf2c-94411dc25130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385547, "uuid": "9a8367c1-77d9-46c2-a702-fd557a7b94e0", "value": "ProxyCloud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a996534-150f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772329057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329057, "uuid": "2e59aa3c-70ee-4525-92c0-e781d7b386d3", "comment": "Malware payload (Mirai)", "value": "e07bb8cfd04bff84deb0be5109511e14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329057, "uuid": "c7711d82-32bd-4fc3-a3a4-44976cf1792f", "comment": "Malware payload (Mirai)", "value": "54c269af1eed3678e83b981aaa0cf5ac7866218ad8b90985e35db98724c689fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329057, "uuid": "7ce1007d-8a57-46e5-ae10-e67b113f0ac7", "comment": "Malware payload (Mirai)", "value": "e7f806f740135c57e6c756d499274c38b3f260e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329057, "uuid": "272bf207-a071-431b-b3c4-f39a4eaef6bc", "comment": "Malware payload (Mirai)", "value": "44a9812ff463c58b90a5642c42f4750446d4a9ea950c61bc09529c048aae4780285f39f16ef0703074551a36d2470a6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329057, "uuid": "2955d6c6-3524-4ae3-a55b-b35f679ed319", "value": "T1B1D33845B9829A27C5E523BBFA6E018D332563E4D2DF71178C215F217BC681F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329057, "uuid": "10a903e7-3959-4a86-9286-a710edd142b0", "value": "3072:snFif7apx6XS+kUgpjWXlsCM48GWoEqRziQSS:sn8ZS+dQWXlsCFEobOQSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772329057, "uuid": "7f1a36d3-df4e-481d-bd8b-ce7a65eda5b3", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772329057, "uuid": "324e0b2b-368c-41cd-ba28-77f9df07995a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329057, "uuid": "f9f4b061-a6b5-40e1-b5f7-378f0016fdca", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7362334a-15ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772397013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397013, "uuid": "74984c49-4f26-4067-bf73-94efa8948eb4", "comment": "Malware payload", "value": "f8561fb1e78e47ca1c099171cdf0f273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397013, "uuid": "fb059d1c-72d2-428b-a3f6-31caf3e0acb8", "comment": "Malware payload", "value": "55adc615456b6e86780057a8c2d49f5fb8046d7fc7b6a50eda85a646d99cf18d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397013, "uuid": "9d07a6da-aa27-417b-b23d-ee2b7c3f065f", "comment": "Malware payload", "value": "b853fe0b6593100b234a101ca8919e183d1f0534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397013, "uuid": "e48b5133-4394-4536-922d-eb91fdb59fa6", "comment": "Malware payload", "value": "a431b4a4e8fe219370b1276ec276d16839690879f53af4b3135edc5d69c89d2e6f35ebea4e5e7c7620df8888d1c51380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397013, "uuid": "cb2b925b-d4bb-473c-99ac-e1baaf814ad9", "value": "T111064A139D91CAA9E09AE2349CB66166F634B848073177D31F636E346DB33C06A37F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397013, "uuid": "0bb02016-4381-48c3-a58a-e9a740d62232", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397013, "uuid": "643e2452-bf30-420b-901e-f10e9680ee03", "value": "49152:L+VJ0PHOYAWLDhdk6t4xF9bjE+CVIFnzdZJ:LIIrpu1hr15ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772397013, "uuid": "c272348a-e778-4ac3-a6f9-3e7ca1879ac5", "value": 3984506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772397013, "uuid": "7b743ef2-51c3-42de-9262-833cfced4b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397013, "uuid": "d3ecc5ec-9466-46c5-9f8d-7976ed691271", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35aeafab-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357396, "uuid": "b5e03698-3938-4c27-8df4-dd546ce27e3a", "comment": "Malware payload (AsyncRAT)", "value": "3310f622e3151c9bc5466d3f8688a15d", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357396, "uuid": "aa3779d9-f848-4f1d-8fd7-3a419daefaaf", "comment": "Malware payload (AsyncRAT)", "value": "57706e874cb14057571ec874d87c53d56fe800ae4eefd5e71bfd4271403d9f89", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357396, "uuid": "9649af0c-6d2c-43c9-907e-13b9db7a9b67", "comment": "Malware payload (AsyncRAT)", "value": "1519b9b2eefcea722b0ad9c9933666ce58febbb4", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357396, "uuid": "50f16949-9a8f-46bf-b5b8-1e4d64df5436", "comment": "Malware payload (AsyncRAT)", "value": "0ed6eaf2517adc9641a88569f8371fc8a237e41b7f1b6a6a0d300c1a6b8d52958ae09a10f38bcb21d58f2454dd7d9d36", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357396, "uuid": "4f5c3c6a-74ca-4ada-8cb2-ec9da92ab87e", "value": "T100F4235AE7383D9FC448A6278ACF87B68C0454BE617F46384A74D7926EF328F950940F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357396, "uuid": "6e532c8e-6a42-49f8-b27e-1cfabc34d08a", "value": "12288:O2yKRFKbKxezyQFr1jnooED5bFrGjo6BAvWKbJVQPfZSxUc4yRT9rWOPC8jmWCyL:8aWzWb1FijoRWwrIFRyR5Va8jmWLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357396, "uuid": "cd98f2d3-bf99-4274-bee2-a08c053681e0", "value": 773623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357396, "uuid": "7673f423-c6dd-4318-9eb8-9edf43d397ec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357396, "uuid": "f279eccb-3efe-43cb-9c52-21b1e9917280", "value": "57706e874cb14057571ec874d87c53d56fe800ae4eefd5e71bfd4271403d9f89.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c146735-1578-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772374184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374184, "uuid": "453463fb-c160-4bcc-9cb0-46ffed47c4d1", "comment": "Malware payload (AmateraStealer)", "value": "72c22355340615916f66c65a0e62b095", "object_relation": "md5", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374184, "uuid": "ae0f83c0-e62f-452a-a8c5-5c77d546ee5d", "comment": "Malware payload (AmateraStealer)", "value": "5775367d227515a556a10cb29fe0272509911b26699f3c59681cae9bc3886d03", "object_relation": "sha256", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374184, "uuid": "3551b21b-158f-40d2-8294-d54105c1a236", "comment": "Malware payload (AmateraStealer)", "value": "561a260318c68033d2a3b1649b2ac90a6562ba46", "object_relation": "sha1", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374184, "uuid": "d97ea79c-d8d8-46a2-b9f2-645c5f004b74", "comment": "Malware payload (AmateraStealer)", "value": "f59d63f285320fc55c579178cdc905851860b023ad26427d3ff23682bd09f095838299876195aaf9d2b40520a3d42ba3", "object_relation": "sha3-384", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374184, "uuid": "21d281ba-a493-4868-a870-ca59044e6a1e", "value": "T1D9955B00EEC744F2E946163269A762EF2734A8050F3A6BD7CB40397EF977AD51923349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374184, "uuid": "362ea2db-5674-4557-ba84-d4c1d876e76e", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374184, "uuid": "4aa7a60c-c112-499e-b923-8a4a896dd2fb", "value": "49152:ip9BnjPHjipTvlKsCjGQ93+l6KHaTaFXkl+PNR:2rnjPDipTvlEWP6Iu+PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772374184, "uuid": "a6c084b1-8890-4d8a-9772-f0dd7d84d676", "value": 1981957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772374184, "uuid": "82373bd8-9447-4f91-bedb-15ca9d83f113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374184, "uuid": "30d0eaa4-0299-42c3-ad9b-867f87e24165", "value": "blink.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bef8c5b-157d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772376277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376277, "uuid": "e07c404f-f6ed-4524-814e-94e0a948e3fe", "comment": "Malware payload", "value": "0eb2b084097f956db8b07b4aa6d516ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376277, "uuid": "aa295315-abde-4364-bb9c-ddf2b50f312f", "comment": "Malware payload", "value": "57f2ac5bede8fbd133b245c70f1f5aa09277cc735c55b1aece5cdc47b92060eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376277, "uuid": "7f9085bb-4748-4877-ba78-09396932fab4", "comment": "Malware payload", "value": "c63fa34bad2337b3f89c187ab4b784507cc34b31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376277, "uuid": "3a888cc9-091d-4617-a263-1e1ffa63e653", "comment": "Malware payload", "value": "ca67b4ebb612312737c272c915edd84e1393b86600dcde3cf8e5d2b5f5660aedcc5deec943de4be6196867f805b4d0ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376277, "uuid": "c13838dc-48ff-4520-be2f-bd2182c917e6", "value": "T11037230BBCA144E9C0AED631897651927B71BC5A0F3153D72E84B7782FB2BE09DB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376277, "uuid": "0cfed194-3835-4cf0-b904-aa142a9a8057", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376277, "uuid": "dfdb558a-0c14-4a03-b2a4-8cfb0efcc10c", "value": "393216:NCJQWPq0DkmUKl3hUJCAgm1Snnk/ISXAJ+4YudehmQS5qsfaRA4y41G5Lbl1vRoo:NCjLUK9CJCAgIk4l2RjcsOliLbl43q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376277, "uuid": "33e69439-cd77-40af-ab71-8d8dc1064d8a", "value": 24100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376277, "uuid": "4fcd261e-b40f-4750-8c49-5faa09e164bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376277, "uuid": "d55e7877-abe6-4f91-a72a-02e180d6b42f", "value": "0eb2b084097f956db8b07b4aa6d516ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066a7fb3-15ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772397260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397260, "uuid": "10a086d7-f6d4-4e4d-af9e-a573e779f682", "comment": "Malware payload (Mirai)", "value": "df258065b2acf3f09531e79b05f78a8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397260, "uuid": "2d4249e7-a710-4630-ab8b-e69a707a9702", "comment": "Malware payload (Mirai)", "value": "58188be8a8586f3137051708279fe6e2c7be4b679c0cce9fef60d1a43ccf0c17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397260, "uuid": "bf55d28a-7699-4dcc-8cb4-ca3ff8f3ce53", "comment": "Malware payload (Mirai)", "value": "7e78fedebce5420c7dc1dd954de3637eb237dff0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397260, "uuid": "5c73a8d4-8088-4f84-aae3-7b53c5465b02", "comment": "Malware payload (Mirai)", "value": "0c56f899e2072b17b7046c0d59ee653da0167694314377258c8d8522869945463e308c6af255fead869ea4d09f5b8c5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397260, "uuid": "1b6e3c8a-1472-47cd-9739-8914d30c7ea7", "value": "T18824C709AF550FBBDC6FDE3702E90A0529CC650722A83B763674D528F54B90F5AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397260, "uuid": "454c62e8-e1f7-453e-a213-0c682eef5f66", "value": "1536:4VWpg/+9neRizMu5K62HCTrNppmSb8xCQgGuWwwO5OZCAjZThRlnEwOx9Sl6WfFk:9mk5K0Tp9x5XO8BDWf3QRsvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772397260, "uuid": "8c355744-9729-42e2-a107-4f3e868cf73d", "value": 211192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772397260, "uuid": "a9d4c592-0653-499b-8b77-80f989d49097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397260, "uuid": "b306ba17-5249-4faa-b7a1-c268aad43aef", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c672b4-1589-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772381555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772381555, "uuid": "a529f6b9-c6d2-4687-a3ae-999017dd4bf6", "comment": "Malware payload (Smoke Loader)", "value": "93e8bed98c864737072495bd8b436e3d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772381555, "uuid": "30396123-10e5-4bc4-9d3f-e48b6268a688", "comment": "Malware payload (Smoke Loader)", "value": "582b9a4424c0f348efc7115fd729580dda6592c329946097c4436d9a0155a96a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772381555, "uuid": "7702aea0-bb78-4686-a288-65b304023d9f", "comment": "Malware payload (Smoke Loader)", "value": "315d5958b05f9f51f005110fb3cff6eb8fa1f6f6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772381555, "uuid": "af82ff35-4a84-422c-b08c-6dbbbbb25cbe", "comment": "Malware payload (Smoke Loader)", "value": "d7957428555e159b48d89f49706f57102c8001cd93bb5eaa86024c7dac18feeb0876ed792ce2b1e4c1dbe9e6497782d2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772381555, "uuid": "4669ad5f-05b5-43be-bf44-334302beb0c4", "value": "T16B75BEF02FFBD816E1AB6F74986299207A2F78C7B960CDDD9400C1495BAED385834F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772381555, "uuid": "f576a961-0f80-446f-9d2c-e803204cb072", "value": "24576:hAt2t0MXnHIPu/6bA6EwAqF+y5VdL9nkbKdNXlkJ9sOdpt7l5qVo:o2yMXHNh6htvBkud9U9sOdptR5mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772381555, "uuid": "8eba8a80-e5d0-44f2-bd95-448a75a6e2da", "value": 1610776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772381555, "uuid": "e8e990d2-eba8-4836-8ac2-94a8ae89d6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772381555, "uuid": "af16844b-2534-48cc-8ad4-13d6087998cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedc20e3-15b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772399368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399368, "uuid": "dd4639ba-5613-4d04-b9ed-1bc760ff6615", "comment": "Malware payload (Mirai)", "value": "aee16cc7a6b581f17c7c87b92b033344", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399368, "uuid": "ba9f7011-ef0d-42d6-a5d1-f816a4b45b19", "comment": "Malware payload (Mirai)", "value": "59c5e84481158593af51c6f06b112f2b276c7774614677b42667c01a5c870807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399368, "uuid": "d5d7a759-1f79-4e2e-a852-15b6941429a4", "comment": "Malware payload (Mirai)", "value": "2bc694159eee3153f0b3c732cc7527b773b872da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399368, "uuid": "d1c565af-adcc-4e39-8775-2228ad539e56", "comment": "Malware payload (Mirai)", "value": "34b14f3ca6331573fcd8d1e61eec95e33278c05941a5c1583ddcdba8384fbf713eab3f48a0157586430e5a8e53149c4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399368, "uuid": "d1d1f603-506f-4701-8a14-9b9237d60f65", "value": "T191C31A56B992DB11D5C311BAFB9E514933132FBCE3EE7202DC206FA067464DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399368, "uuid": "bf0cdf31-98dd-4318-8f40-5b70f9effa5e", "value": "3072:7rJStQ4kaiI4hvSvSToRRa7bcR9ekLBscaL:ZStFMTvSvkoXaP0eklaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772399368, "uuid": "1f83fc15-abf0-4d8a-96fb-abad289844c5", "value": 123744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772399368, "uuid": "225a63f2-585d-4fc6-bf1d-f6c6fc70b468", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399368, "uuid": "8a0445aa-acd7-43e8-8493-cb90f32858a1", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec641e48-1564-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772365863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365863, "uuid": "408ca4c9-beb9-4e07-a88e-04133442c5a7", "comment": "Malware payload (SantaStealer)", "value": "2d4a9ec495505dcc95290fea3c81bd0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365863, "uuid": "a9d77614-14e7-4cdb-9735-2e5a0204a001", "comment": "Malware payload (SantaStealer)", "value": "59f1858fa6f8d719423fa7e0e173e3e4e1c0ff717231518318ed970de38ffba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365863, "uuid": "d788a9a3-fa5d-4db0-a61b-70b49a7898f7", "comment": "Malware payload (SantaStealer)", "value": "ca610b7dcde4701f51e5f9bbe44217b894160146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365863, "uuid": "1764865c-8fb6-4f93-bbbb-ce4af9769769", "comment": "Malware payload (SantaStealer)", "value": "e41a71115ff5570ce9f57495e605663026f3b8ef0371b42fa10ba7b3457da5ed2d2554e62175785303ccaf45806e27dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365863, "uuid": "91593347-2b78-439c-af84-4048532111c6", "value": "T168F6281010D96607FD7EEFBD89DCB6444F7AB2953722EA389B410DE90FD1B08C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365863, "uuid": "6cc5c0aa-82d7-40cc-b212-da303ed12e49", "value": "196608:s0c1Tdl5XWWtWlxJZkmyur1l8QXvdGwNPchZUJSpVHakf:sxH5GWtWlnZkkGQ/dbPcqQV6kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772365863, "uuid": "8976b2d1-8d36-46c0-a2ba-fa7af73a7146", "value": 15973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772365863, "uuid": "969b2821-d1be-436d-8549-a116b4326077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365863, "uuid": "496def89-2c22-4adb-9dd6-6dfaf5f56e2b", "value": "Belium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59deed86-15b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772399118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399118, "uuid": "a8e75a6e-2995-4566-9461-d0ea364d70cd", "comment": "Malware payload (Mirai)", "value": "26f202df7e742873e464a8817655ed6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399118, "uuid": "9744117d-3c6b-4b8a-aa59-a2e7aff9dc3e", "comment": "Malware payload (Mirai)", "value": "5aafc40dc36ba73384611099b2722543219b75f031de00dcd46e2a052f4b2ab8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399118, "uuid": "ef6f7c71-db46-48ba-99f2-ce14b72e5caa", "comment": "Malware payload (Mirai)", "value": "e5c29e2888110c9368ded8d7423a50e69149aff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399118, "uuid": "633f48e9-1291-4ac5-98dc-dab4d0a17071", "comment": "Malware payload (Mirai)", "value": "9529fcf6d50ef557bc4b297a7a47a1096c0de95622b5340c46b314b4a7e3a1e9f8b785056fb90a4ea9a253cef150dd67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399118, "uuid": "7038d9f4-a77c-448f-895d-8d40d175e53b", "value": "T1FAF3BF9BB74B5050C8E50AF81BCB4F9C2A2721055E7B98E7BC1E363969375DB180B3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399118, "uuid": "04248853-db9f-46c2-bc8e-b2cb67219b9a", "value": "3072:JpmsRJEMRJjDrUxEvhNGwP7WfNdBp0x4jg7CEn3u5plq:JHRJEwJnfvhpPKDf0x1Cu3uNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772399118, "uuid": "5b7e5e6c-5256-4841-b5a3-c38cfea255bf", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772399118, "uuid": "55d27239-c0ac-4d86-9edf-c69be5ce0071", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399118, "uuid": "ffc7043f-fcd3-48a9-8fe7-a327a928f64d", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5af616-156c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772369223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369223, "uuid": "ab736fc2-1c37-4e41-a7bd-5e5131efb0ae", "comment": "Malware payload", "value": "72ff131359f0cb753e7892ab3a81ad4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369223, "uuid": "2052dab0-6488-4f8f-a19e-24c541cbf1a9", "comment": "Malware payload", "value": "5b1bb021a7f49524cb4a8e91e34282fb30134afe6a5ff2bbb2caa32a26b5b0cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369223, "uuid": "4ea5530a-0fc7-4bc5-acc7-769ca6c65df9", "comment": "Malware payload", "value": "f5c4fc6a9e6cb5e143dbb2e601a0e9e14f32d40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369223, "uuid": "f42fa906-5ea7-4807-9483-da45480806a2", "comment": "Malware payload", "value": "18c2a01d41b09325773a915f66f54dde941845a96b3c56799fcdf3c6ee9234c30b2b46bdee0407fbcc7267cd7c7f7d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369223, "uuid": "133067f9-f6b6-4c5e-9251-7ccbe998e1f1", "value": "T1349353E5BAD49CC6EA74927C22D5D232263DF9E045534B07D4206A321F13FD23EE96CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369223, "uuid": "b01d4306-00ec-4be0-8fbf-b1cf120df625", "value": "2bff6dc3ae897d1d981a501e2eb67811", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369223, "uuid": "70b679ea-3ffa-4f2e-83c5-b5b6c3bcc720", "value": "768:ZAZ4SUX4ijjUJAo4scIqqpu3UmnCY1hBQfyeAsDXUeiJXv49VQ0YjYDO:ZAZ4SU3YJAK5qZ3UmjhBQftK/49VpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369223, "uuid": "e2ad4fbf-2f6c-4059-aefe-5c962354b7d2", "value": 92749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369223, "uuid": "2f3898f9-41c7-4b1b-bbac-74008e2b68a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369223, "uuid": "c02d9404-3662-47f3-a8a4-1ef5b92db1e5", "value": "Pepperwin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0168b8-155d-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772362802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362802, "uuid": "b866c331-4265-427d-9c91-f3ca83457458", "comment": "Malware payload (QuasarRAT)", "value": "bf0eb2c59ce092e1473711fc8848379e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362802, "uuid": "60572213-b364-464f-acf3-f7843df7e47f", "comment": "Malware payload (QuasarRAT)", "value": "5c65acc432e8d2dfac0663c8e922a9af3dc0d5846617f62ee5e7ab9d431296c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362802, "uuid": "6110e21d-4aad-46cc-b218-54b2c0eabe6a", "comment": "Malware payload (QuasarRAT)", "value": "b2a2e042d7455e930de2a0936b1b3366c8326eff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362802, "uuid": "46eab081-e942-4cf9-a21b-be1303d0e13d", "comment": "Malware payload (QuasarRAT)", "value": "9e195af6a1b3deebddabf25c343284ff93bf9716c1107497885a824d32cc5374a1034749650868995e112d65764b2b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362802, "uuid": "555b5ff2-14a2-434d-8ca1-49dc6b66002c", "value": "T127E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362802, "uuid": "00f760b6-31b4-4879-915c-eca104a479b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362802, "uuid": "a8ae7efd-9bf6-4a74-b3aa-241fc6707d79", "value": "49152:rvDI22SsaNYfdPBldt698dBcjHHtRJ6bbR3LoGddkTHHB72eh2NT:rv822SsaNYfdPBldt6+dBcjHHtRJ6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362802, "uuid": "9a087033-1c00-4449-8706-07f0d25db23e", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362802, "uuid": "8febeba9-d922-44ab-af89-2b734f8fbfb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362802, "uuid": "deeaa121-1c22-415e-8a32-8e6720f76b19", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1571a6bd-156d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772369368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369368, "uuid": "0b2a047b-907a-4942-9f87-b47130b20ce6", "comment": "Malware payload (AsyncRAT)", "value": "150fc660c7da585cb493fe53e8c5f29d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369368, "uuid": "3fd28b21-650e-49f9-a1db-f48056329285", "comment": "Malware payload (AsyncRAT)", "value": "5d5f00781233647d2083afc25de85c046e40aae3645cfd64338ed9886a77b50b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369368, "uuid": "a6eef82b-ebd0-4608-9a78-bf00cb612f6d", "comment": "Malware payload (AsyncRAT)", "value": "83b0b79957b1824dfe2bc52d164b991b3e82f6fb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369368, "uuid": "88b9113d-06e5-4d3e-8482-6d8e4f48d43c", "comment": "Malware payload (AsyncRAT)", "value": "b92cf2e92bccbbfa0eb83872338c34cb5fb0a8bbe45eaa725fc5c1b4c304073ab7bcc9225a9ba4e54be3a097d873b524", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369368, "uuid": "1b0de21d-ca70-4e18-a451-c4947df7e9ac", "value": "T1DAF24A0573E58665E1FD0BBD5C3686044376FA474D62DBAE2EC450AE2A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369368, "uuid": "84f73fa1-785b-4558-bda1-c933b6c7a424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369368, "uuid": "c16b20fd-762f-42e4-9764-8809168efab4", "value": "384:+MTZPkBc13ohM9oehElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCs6WWKEN:+iZPGc5ohM9BhT1hV4RbJwB+WWg1Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369368, "uuid": "b5b42bae-10dc-4d3b-948b-5844f582914c", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369368, "uuid": "19bbe23d-955d-4ca5-9950-d6291af8858a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369368, "uuid": "db3a746c-0007-4679-aacd-d1e004cc0470", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c788c8d-150f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772328980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328980, "uuid": "3e125d21-8b83-436f-806b-a3e935ca3d7c", "comment": "Malware payload (Mirai)", "value": "35f4c2529e1b0b1e582d0bf5ef0f651f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328980, "uuid": "80a7ee5a-33e9-4000-a558-ca962930f5c1", "comment": "Malware payload (Mirai)", "value": "5dc86c68295c993bc1bb8dc8c4f3ca55824a542d19f4f319f2e6245524424c93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328980, "uuid": "3bb84a71-5e28-479a-a3cc-ea3f940312f2", "comment": "Malware payload (Mirai)", "value": "0f1a81634c0022a6985d7b2696a1038b3a6646bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328980, "uuid": "c6e08945-dd94-44fb-88fe-d9d864790208", "comment": "Malware payload (Mirai)", "value": "a92de18e0a95129d151b4e5773e4ca55f54e34c1e60f3258c58dacfdfa866e6b37d3fcadd9a0aceef3d8cf351f03cda6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328980, "uuid": "9e5b23e6-7b1e-4d8f-8b74-609071fdd36c", "value": "T1A943C75A2E21CFECF66987344FB34E21A6A423D623E4D685E29DC9002F6035D945F7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328980, "uuid": "2562ff64-ca7e-4567-87db-d5099f80ce85", "value": "1536:ET6tGLwXLIgaX4kd8yLAG+m/LwiB3aGCv5D8pFVewrKn:ET9oR8pFZKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772328980, "uuid": "d4511448-f0b1-4de6-a057-0749c8f76fd4", "value": 55604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772328980, "uuid": "f0258e93-2ffb-4b9d-bb3a-a1307d2a4b26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328980, "uuid": "96bf6d71-6b33-4b95-bacb-6b4e0994fee1", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7d0b25-156e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772370190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370190, "uuid": "0a16280b-131d-41f1-90c0-97fa2fdde962", "comment": "Malware payload", "value": "44637dd96efec45a6f7c860b912a6dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370190, "uuid": "9dea8968-f2ce-414d-90bf-3ae6195c1dd8", "comment": "Malware payload", "value": "5ef5f4bcaeb9a0938f574ae75fb159c99df32a3a11a9c26e6ea2b0d8ac7a139f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370190, "uuid": "ad15331d-4cc6-48ea-b22b-27e163a86a54", "comment": "Malware payload", "value": "c52de02b31942eca2db7b24ad0000fc9fb8693a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370190, "uuid": "a80dd24b-57bd-4313-98d0-104afaf27431", "comment": "Malware payload", "value": "845107464fd6ab6db06ea5bc9b4ff4effbd89306ead037a21f2647462d60632b455ec5d7b6b3098af1fabe49f621ddd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370190, "uuid": "b7b81333-71cc-4675-abad-18db144aedbf", "value": "T121E6176B76A18669C21DC23AC0B38F01E9F371BE1B73C6E753A003685E4A5D45E7E670", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370190, "uuid": "f2c8bd6a-0a1d-4bfd-ac1b-32badf2b2165", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370190, "uuid": "dda0d6e8-e304-48ea-b9f1-8644f17180a8", "value": "49152:ZfH6uLQa7DDHSgaVxb5uBoWVCJGSVOvfz+ZyefFAkOILbvSy6fWixMGwOI/e8bBC:OfbvYfLRXJbWCnIwjJd/8+pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370190, "uuid": "06931ae7-a3e6-4acf-b04e-89d9df2b9177", "value": 13965824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370190, "uuid": "f24a386f-5cde-4633-a878-e7a162a3e3e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370190, "uuid": "c4c3f60d-0cca-4bb9-979b-599102c29feb", "value": "SecuriteInfo.com.Win64.Evo-gen.59692643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09b2589-154d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772355991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355991, "uuid": "143d27f0-a804-44fb-9e25-d78d7ccebb01", "comment": "Malware payload", "value": "55c2721acad39688475a6b5baa50597d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355991, "uuid": "d566fd0c-92b0-4ccd-858a-07206f14f209", "comment": "Malware payload", "value": "5f8777c61e44b83c2248277d46de01485a9810f923ff7c5775349f1fe288a61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355991, "uuid": "24b8df9e-6ff0-4f00-9a95-2c3a4cf7e108", "comment": "Malware payload", "value": "6f2ac8752b13926875ee8c2769578fd62bef1142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355991, "uuid": "b8ab8aac-e614-423a-a3c5-87a9a478a892", "comment": "Malware payload", "value": "416659f1e80e25be137ff74172efa0d3aa67a5c4c66e6506ade26cad92283a83e8c6a371d234d2afbfa139d44942b5b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355991, "uuid": "0da84544-f58c-486e-803d-5f753b002655", "value": "T17308E00663E116AAD577D2388AAB6503EB73B4071330C7EB329C43652F63AE45D7E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355991, "uuid": "dfc09637-3b4e-46f4-a1c1-491650e9d907", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355991, "uuid": "66acbe7b-2087-4e8f-b37a-be0c5ccb9e03", "value": "786432:6B5zM31we2iBrxDvIEMwHVCgPiTviURVJVWV1CVuWwoz3faN+BRWYF3eKYpiW1QB:6rA1wejHt2iURVJVK1CxPyqOBpiBnV4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772355991, "uuid": "0643e938-0c85-4677-a4bc-fa8e40de467c", "value": 81314885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772355991, "uuid": "02da058a-ff9d-42ec-9981-eb6fb2b32d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355991, "uuid": "8c1b83a2-6dd5-45a6-b97d-ec36baddf835", "value": "5f8777c61e44b83c2248277d46de01485a9810f923ff7c5775349f1fe288a61e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012f8764-15ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396821, "uuid": "30f49100-2dc0-4e1f-a71e-6a5d4001c238", "comment": "Malware payload (Mirai)", "value": "0db4dbbc7201e92acd8a87aa314f723f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396821, "uuid": "a15163a5-129f-4377-bd6d-754fc74522de", "comment": "Malware payload (Mirai)", "value": "5fc37eb5f88b5783aa6376a62f25f601a2146b1999115e922d47368e8a7a9074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396821, "uuid": "305df3e4-9699-4056-aa95-f5b9c100aba8", "comment": "Malware payload (Mirai)", "value": "ada8f7c3a597109b778586a8051708816d54b0e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396821, "uuid": "2cbde6b6-3383-4bf5-a49b-6f81aaf18d42", "comment": "Malware payload (Mirai)", "value": "8d7e051bbacfa5051fc65859b1da7900f8653e51487fa1e66884b56fc020e6297bf87e9dbdd842e95b324f547bad5baf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396821, "uuid": "a188c3ed-8e03-4775-a180-47def57d9e1d", "value": "T1D40428D7F802DDBAF80AE3374C538906B130B7A119825B3772577B6EED3A1951423E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396821, "uuid": "fece1b57-111d-4df1-b30a-a28d1f9fbf9b", "value": "3072:ovO2uP8q3y7xCNs1jyzPfWRT5Nv2iCj0NStVwjbizLlXV7C8WZLe92:YOmxyznWRtN+oNS5LlXdwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396821, "uuid": "129c115a-7aba-4efd-9954-d04e71cc1db8", "value": 178528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396821, "uuid": "38cdfd6d-73e4-48d8-a9c7-07d05180ddd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396821, "uuid": "883024bf-f7cd-427f-913c-2f08c16e6bcb", "value": "csk_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f020609f-157a-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1772375318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375318, "uuid": "024cccbc-e344-408b-8196-29e61be9f593", "comment": "Malware payload (Stealc)", "value": "dd8a661de4071adeaf2c93406b3c8725", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375318, "uuid": "dc346223-1111-40f4-88fb-2166c55173ef", "comment": "Malware payload (Stealc)", "value": "601dec97c0ada64009cd7de35966d976322470b185a64dbc45f22feb33a2dc63", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375318, "uuid": "2f91b8d6-1256-4f87-b7a9-6dbcf0713148", "comment": "Malware payload (Stealc)", "value": "c08b8af57a55df1a9dd007d0acdb376c99f5f87d", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772375318, "uuid": "4e46214e-15db-4974-8d8b-ef146ea80e8a", "comment": "Malware payload (Stealc)", "value": "41c682756fbd7b6a868ce978e07a49045d233c106c0bb4f9e1a5db722993c6058fd62c675df7dc063245312931576a7c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375318, "uuid": "89f21131-ec78-4a58-9c76-c243e8444ee1", "value": "T160C57C0B7DE51CE5C86E9376DCBA11827B31BC490B3223D31A6579782E736D09D7AB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375318, "uuid": "c78e6f01-0131-49e9-a217-6bf2ef760fa4", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375318, "uuid": "9aa0bb5c-c35b-40be-9a60-5b7e6676ab7e", "value": "49152:V772LjTr6vcDarzmHUdTT6/j7TvDlTyBUP:V7ofMXmS3OBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772375318, "uuid": "c7124247-6ec8-483a-afcd-3cdd897a9d14", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772375318, "uuid": "41016feb-a660-4a1c-9c63-2aafc80940df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772375318, "uuid": "b3d1c973-4518-40ff-a2d5-8e31a2acd8f9", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a156879-1550-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357081, "uuid": "0981fe02-f4dc-4577-8386-615d35143b99", "comment": "Malware payload", "value": "02b4af4fe1f41906487e05ef0c6b9805", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357081, "uuid": "023f5dbe-5006-4d64-b0c4-048e51f5063f", "comment": "Malware payload", "value": "60826cc7ca0ae74f2a319b7427ee7990f1a73800bba7bd725ddcb59c398a7349", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357081, "uuid": "d65c0b2b-b8f5-4c4b-8bf0-855a06254ea7", "comment": "Malware payload", "value": "817a06c8397add89ff459d64a19da2fbccd7ce60", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357081, "uuid": "40a7945c-74b2-426a-9d48-8008b7079846", "comment": "Malware payload", "value": "672f0891a61210399590833d4bb7ab7c1d22bc53ed89e6c1c8ec674296f59bfe147a6c098572979d9465c85c5c23a89c", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357081, "uuid": "7f6ad8bf-d921-41f5-bfa7-3211010d7c9c", "value": "T1A933F2FB047C42D35F026A3F8EAA912F50F1CE48799823A5754FB3815D36629A6371B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357081, "uuid": "588fb211-f4fb-4bce-97fc-642cce9d328b", "value": "768:Y+bp7kqrT4HE5rmUCsg+/PAQM6xI5nyCn3SnNUFmIO7Nxx1FpZhEX+qfMzjixtCE:75rmUCsHgLF5nyzegxx1Xf8dfAjixtCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357081, "uuid": "de0fd2f7-96e4-427b-b736-d1c2ad2c7b5d", "value": 53368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357081, "uuid": "b277816b-2838-4f8d-9669-0267e2e13c2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357081, "uuid": "4fdf581d-b733-4571-a6c3-a950a283c046", "value": "new.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f3a687-1579-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772374579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374579, "uuid": "52d95d07-ed41-4a8f-9952-1ae9e2a6193a", "comment": "Malware payload", "value": "6a09cf01811f78f0afea0d8eeda8bc22", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374579, "uuid": "49f78462-0deb-449c-bebb-588a1c0f629c", "comment": "Malware payload", "value": "60b85c9b2cf4c0aaa234d575df224efbec66247809e04f6f0e648bc10032a302", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374579, "uuid": "89024fc0-88a5-4ac6-bada-f41e0b9283ce", "comment": "Malware payload", "value": "0341ef26701eb657eaf4bd473baefa36ef3cbeb3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374579, "uuid": "0bca5d5e-4cb5-4c5f-9aca-32b3613a558d", "comment": "Malware payload", "value": "c2e6326be27cedd5896cf9c50486f77228f5f3663553d68202eb949255cde92d5a1800a2823530fcd2c3b8c45cbcfd79", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374579, "uuid": "1244fc48-55b3-46f8-a2a3-155c6dd193a9", "value": "T106924CB506496C79FBC1CE799F3C7F0CAEE582C42128E3ADBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374579, "uuid": "c6ce2f88-8a44-42e5-91ff-47486eb808b6", "value": "384:JrincuxOLnVYMSDzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:tpuQL+DzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772374579, "uuid": "4ca4edac-4271-490d-9c52-f11bdeef70d4", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772374579, "uuid": "122202c5-4def-4f8e-8248-9d9da3e1fe9c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374579, "uuid": "b6eea2c4-8d84-496c-8525-9b2f85324f7d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cbc57a-1572-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772371600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371600, "uuid": "b28af203-fab5-48c9-9884-20db93b74ccc", "comment": "Malware payload (AsyncRAT)", "value": "90275ef9d7efedcc1349acf57b00fd1b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371600, "uuid": "cfc05607-18cf-42df-997a-3b840933dff5", "comment": "Malware payload (AsyncRAT)", "value": "619f3fd621c7ee290bbe24bd0734ac3382b60a6e1d047e137e617c9189c0e8b5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371600, "uuid": "09885d2e-a763-4f74-bd8f-1b26797fdb3f", "comment": "Malware payload (AsyncRAT)", "value": "bf3560945a7a5a1bdb5c753a174bad88f80bff10", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371600, "uuid": "c5e40587-1e3a-4135-bf84-3ec85421304f", "comment": "Malware payload (AsyncRAT)", "value": "b072e7b36536bb34723e78543e04a3e6556579abfd023f6b40312bd903195ef46993439eeedf368783c3dfd00ae911a1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371600, "uuid": "294ded2b-17d5-4459-a4b8-c7e6cd32433e", "value": "T1D8F24B0573E59665E1FD1B7D5C3686044372FA478D62D7AE2EC450AE1A237C8CF14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371600, "uuid": "f0c98cbd-6417-4804-ac92-3f244b143fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371600, "uuid": "f788bf51-6a4b-4865-85a5-08c0712caece", "value": "384:/MTB2LD1mD+YR4hulE1bdcWOe7X093bayseHQxnC7O+WmlIuufGfrfCQnWWlEQ+:/iB2fED+Y6hR1hVYRbJwB+WWV6Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772371600, "uuid": "6a56e659-3203-4bce-9517-85e26310ce5d", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772371600, "uuid": "518592f0-700a-47ff-b893-e9227e9170da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371600, "uuid": "2a16e7d4-a635-469a-8706-07d2b857c252", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eed341b-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357411, "uuid": "23019cd8-f390-415e-a585-6c0c5c6636d4", "comment": "Malware payload (AsyncRAT)", "value": "57a2abee8b07b693874e50d03ed7d6c3", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357411, "uuid": "a88a2b0b-00b8-40ac-b0c9-a81db6d64b5a", "comment": "Malware payload (AsyncRAT)", "value": "63c696330e0c2643ca7ab5294a1a72acb7b89957b32a4eaefecff0a5a2bd7f27", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357411, "uuid": "c9df1b13-f18a-41db-9b37-370fa796ac4d", "comment": "Malware payload (AsyncRAT)", "value": "698584a6f795b90c539e2ab9f06af41e6bec268e", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357411, "uuid": "c2b819a7-f625-47a2-a409-f74268eb0d29", "comment": "Malware payload (AsyncRAT)", "value": "89139e673ab838e7d6e0316da6cf3ff9f36b858baf3d6956941ae2e7e851eb06cff77ce1ef5ad38c7bcdc0ff822b76d3", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357411, "uuid": "a3b12830-0516-43e7-a56a-318212832c91", "value": "T1E6A53374B9242C65649C280052BE21DDB4680CF7790910ABBF9BDBC59E51743CE9FBF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357411, "uuid": "07aa886f-0bb4-43f7-b223-0c49cf119e43", "value": "49152:CaWvfwfM1VMHhRjehRALiZfKOpmf7qPj/v5ZTA33ikOf5q+xF6abWkosUYaXa6tA:CdMOVMTWAudpmfCj/v8CVA+L6AUsU5HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357411, "uuid": "93687501-339e-48f4-b02c-8ebad049a236", "value": 2239950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357411, "uuid": "6b606a24-4a11-4951-b590-e65f67064514", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357411, "uuid": "86945639-8eb3-4c50-83d1-f523a178188d", "value": "63c696330e0c2643ca7ab5294a1a72acb7b89957b32a4eaefecff0a5a2bd7f27.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe240a1-15a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772394242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394242, "uuid": "bcf0046b-7a73-4e20-96b0-7872d080b613", "comment": "Malware payload", "value": "6f66e651843d742966dfc83f5f32224d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394242, "uuid": "ee80cea2-a471-4d88-b374-462a887a8ae1", "comment": "Malware payload", "value": "66bf25c2ac46a2d9133073566118bc7513ba9d5c4bd9abfe8fe99602b23938fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394242, "uuid": "e022088f-b695-4f49-832e-d0a120ab4fef", "comment": "Malware payload", "value": "2284545911f8a87e059adbbd3c59c65d3f792eff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394242, "uuid": "6bd76c79-f411-476c-b404-7f01de997dea", "comment": "Malware payload", "value": "a3d6c7e093145c8f2a408770f39b32cf5458e21089987ffdc8b505ff29b22cea2e9412863acf6c2ba4339b09c264d4d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394242, "uuid": "5bd1396d-7bff-4629-9df1-5bfea030ba51", "value": "T16DE30955FC818B16CAD666BBFB4E428D372B1768D2EE32039D256F20378B95A0E37141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394242, "uuid": "d6097d11-80e1-4656-9fbf-2eeb72653276", "value": "3072:D0tOCDLzKbrRQvOcqLc5jvVfe42E5Y7X3ClxaZeeTOSt4:otOCDCbrRWOS19e4V5YzCnaYeTOSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772394242, "uuid": "81b4bdad-650a-4412-8ff4-f0f0be5897b0", "value": 154360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772394242, "uuid": "8659c4bc-0203-45b5-a624-9bb527832f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394242, "uuid": "d3c4d37f-13eb-4383-8ef8-5b67a725a751", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1ca33b-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772396548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396548, "uuid": "00c1872a-cdb7-4703-8566-c5ba235625bc", "comment": "Malware payload (Gafgyt)", "value": "dffd6153b4e69640ff8c75e7b042cd5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396548, "uuid": "58f0b9bf-e076-4823-9b7c-50442c55fb71", "comment": "Malware payload (Gafgyt)", "value": "66cb8dee1d681c9cd61b4b3d73a84433c8dfbb1a192968ef7bd8880cebf9f825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396548, "uuid": "0125404b-505a-42a3-9d0d-72503fc11c21", "comment": "Malware payload (Gafgyt)", "value": "5991d1d3dd90f9c5debe930975dff86a6c37f648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396548, "uuid": "b071589b-162c-4917-a623-dfc2dba584db", "comment": "Malware payload (Gafgyt)", "value": "23b774750925eb59130f815dce8b0d02f9aae7fb68de9fde826fb9ed60fbf54f84e1ea31c96c65182bd9a98d34820908", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396548, "uuid": "7fa1702a-a76e-49b7-8594-d787f4ac8cc4", "value": "T172E3980A6F328F6EF269877047F78E31975877D616E1C680E1ACE5441F602CE641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396548, "uuid": "86f5988a-de8e-4095-ad9c-df0b2083aad6", "value": "3072:9MYaTonjJKCxZJlowfGd4g1LV+hPUf9U/R2/Ol:9MYoojQQGdzp6MFcSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396548, "uuid": "2a707315-75bf-49c2-9fd8-45b3e37bc1a0", "value": 150356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396548, "uuid": "a4eee5fb-e204-4c52-9604-48893644d570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396548, "uuid": "412d3f15-5235-430d-9c87-af38cb83405f", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ebf196-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376207, "uuid": "9cae7491-7be8-474a-a18d-b6ececd3c5d3", "comment": "Malware payload (Mirai)", "value": "cbe2b7ce003a59ee3824d078bfa74755", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376207, "uuid": "2f1c928a-0dba-477f-abfe-9db0c8ad3278", "comment": "Malware payload (Mirai)", "value": "67a962d5dde9abb6c589f1a9da633831505d299a1bac6d905f5f9c8d02304667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376207, "uuid": "6355c35a-5cb3-47da-965b-7edd0c0cac99", "comment": "Malware payload (Mirai)", "value": "d07e7e62b8ad0cdafd54226afb7b537794914726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376207, "uuid": "cb921357-c8f5-470e-a7cf-a09f9980e598", "comment": "Malware payload (Mirai)", "value": "bf2fc1abb1cc8d8fda0d5da54f20f1438edb8e2f8908a4e2b9b235b01a7b78181e244f0e451550a16f2e88337fb2d71e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376207, "uuid": "b57a709d-c888-4d4a-9a03-dc67d7cf9d37", "value": "T1A74308CBE353C8F5E84325F011ABEB798A31EC712260D976D7E5FEA759625C2604132C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376207, "uuid": "b478e82e-6930-4f2b-a2c8-a0abd0ab5953", "value": "1536:MJfvefm6jSrRNExDfQzKVGTkJ/Cu32j8M:MdW74ExDTVbJK+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376207, "uuid": "020eba2d-66eb-4478-b16d-aaca15816be5", "value": 57780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376207, "uuid": "458600c6-5161-42a3-bc35-ffcfd2dfb022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376207, "uuid": "b934eac0-8a8c-4464-87a0-ff3f95111700", "value": "nx486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b077d4b-1570-11f1-a769-42010a9c0008", "comment": "Malware payload (DeepLoad)", "timestamp": 1772370826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370826, "uuid": "c93d4c67-10c7-4b59-b1cc-bfc2764bc9ad", "comment": "Malware payload (DeepLoad)", "value": "52e774031b85f5395b3628bcb80d9167", "object_relation": "md5", "Tag": [ { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370826, "uuid": "6f304ea3-9b51-4eef-9a9d-7138e4c98e2b", "comment": "Malware payload (DeepLoad)", "value": "6827d46a465e888daf2c299cd343a3d4ae5f9516123790245aba6f71f3440b88", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370826, "uuid": "e845f519-786d-4e17-b26f-458cb94cff28", "comment": "Malware payload (DeepLoad)", "value": "8baa75571a2f34a971c0dcf025db07905408ce39", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370826, "uuid": "6d863f7b-65a6-438a-af51-4492ff09e7d2", "comment": "Malware payload (DeepLoad)", "value": "1809553bfd11c65f4fc374bf9a9469618eb2b41d39cef3f36285afa585d4ca46efb718b653ffe0928cc832fd20b45e1d", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "forest-entity-cc", "colour": "#98DC43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370826, "uuid": "64f92301-0ed4-4c51-87ae-4fd753f94b4f", "value": "T17C234416EDCB8CA783D3DAA3D2E3D61CBEA4849C81075DC5B5B8C2C24871D694788F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370826, "uuid": "c3c7733f-430a-4fc8-b782-64f4a00bbb22", "value": "768:kedPnEW1LYFlZl4dK5W+dH/u0ZY93dHAZnmi8eK+1:cFfcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370826, "uuid": "2c86104a-d876-4fd0-b610-fe6f46c21ce8", "value": 48524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370826, "uuid": "4f6212ac-34c2-4141-aeb9-c767b5ee1c9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370826, "uuid": "f253cc33-aa59-4d79-9b50-0edccc79d38c", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e7f818-15c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772408662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772408662, "uuid": "d82b7d2e-54c1-4b6b-99eb-91d616fb508f", "comment": "Malware payload", "value": "4f6b21c834c2e25e0d528cf9ec7a6d21", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772408662, "uuid": "4cacb5e7-8b00-4777-b892-67f094106394", "comment": "Malware payload", "value": "69a3f9f658a1278c1a984a7f2d267ea25ffefbe2f0b14f43046983f5a284902f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772408662, "uuid": "935dc25c-6e24-4aa4-877b-87f5cc362371", "comment": "Malware payload", "value": "3cbcac7ea2960ccbe5debe731ef7e487ae676fdc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772408662, "uuid": "9b414942-331f-43bf-a241-c41748720471", "comment": "Malware payload", "value": "f26f8bc761fd47b7dea22e7bebe342db1949e048afed6119f4536d75ae8812af52211c3e8d2d7d3375c01de1e941167f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772408662, "uuid": "654f3dd5-deb4-4658-a42a-71545f629e9a", "value": "T113E22B3DD1C1BCC0C75F23F0B89EA7D5019ACF037A662B2DF6D864661F60264AE76588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772408662, "uuid": "646cda0f-f5df-42be-b2d2-46c80c821fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772408662, "uuid": "7a1448bb-ebdc-46ec-9a7d-4cfef3b42d53", "value": "384:yd0cpHIb1AjacHxex+Jk5b4C3GjqBGmKSrvMlYykjWFYNOZ3XDkZgHoEQMp7e2B5:y+uobKJRkSjmHPpNA4Z/MZew/ig4Rob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772408662, "uuid": "4a6b09fa-72a7-4318-b373-fbc8545a78b7", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772408662, "uuid": "e58aa2e1-1d76-4293-a615-fc8012a21dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772408662, "uuid": "20b6c10c-9cd0-47ba-bf0a-528530de4eea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce62f920-1550-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357222, "uuid": "1280ae3c-11a7-419a-8ce1-461cde907e83", "comment": "Malware payload (AsyncRAT)", "value": "c9615837e11370f48fc5e81d4f13201b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357222, "uuid": "a533a3e1-acd0-4fd2-ada7-215dd4ee565e", "comment": "Malware payload (AsyncRAT)", "value": "6ab1bb11be0e8fc7a004cdf050b6e563eb1f6280a380bc2c1b2d12ba787071ab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357222, "uuid": "a12ccd16-e2be-41e1-84cd-7d0107b49856", "comment": "Malware payload (AsyncRAT)", "value": "654cea9c5440b7faea1abf3a58663d43847764e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357222, "uuid": "73eee304-3da9-4e07-8740-8f8ac068ae9d", "comment": "Malware payload (AsyncRAT)", "value": "c4f3e0c3957b5b6f8a1b43bd1adbd4e931d5130e57b36ed289c3e31531bfef6c6c811f8bb54c133cc80569d3ab6a5e30", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357222, "uuid": "6b870c00-81ff-4a50-a55b-a5cbc6fae456", "value": "T194F24A0573E58665E1FD5BBD5C3686044372BA474D23DBAE2EC450AE2A237C8CF24BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357222, "uuid": "5c22ae5c-3827-4952-b694-4f7341420291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357222, "uuid": "17663aa4-e17c-4480-8c83-a518430b6f92", "value": "384:tMT5C9p1L9w1y6hJKlE1bdcWOe7X093bayseHQxnC7O+WmlIuufGfrfCdOWWBEQ+:ti5C7B9w17hz1hVYRbJwB+WWp2Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357222, "uuid": "9180e331-4c1a-4df3-a99f-312ccf1ef62c", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357222, "uuid": "5ac22291-235a-408b-8bd7-a277abd00304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357222, "uuid": "3f0c3b99-64f5-45e6-bc05-f096a32b3851", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d58b430-150f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772328981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328981, "uuid": "984366ef-592c-4632-b036-fb2d5529a06b", "comment": "Malware payload (Mirai)", "value": "f4d37e3865336e28b8862607d0498b10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328981, "uuid": "e63f485e-870f-4dab-8e33-ad843f6a1ecf", "comment": "Malware payload (Mirai)", "value": "6b41442b2a05a4b95a27537d9f2658f3d22d700b105e7e26631ec75ca660efd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328981, "uuid": "d7554f00-e517-4434-a059-2e33affbf01f", "comment": "Malware payload (Mirai)", "value": "541ac09c25fca1642e256cb5e232bae45b565b43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328981, "uuid": "8bce109e-e041-4935-a53a-97d1d677fafd", "comment": "Malware payload (Mirai)", "value": "38f9cea47dae20490d76867bc74190740ee1bcbddadd2bfe9a762487d836b3c554cf52ab02b54c38798c5515dacd3c1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328981, "uuid": "0ec07f25-ebe1-422f-b5b9-1d4c98379521", "value": "T108C39E32D8396DC4C1945434F8B1EE711FA1A6C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328981, "uuid": "9aace20d-c459-415f-a680-d8109dad996d", "value": "1536:6aZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKLYUIaXwDrucKygHIwS8w+NrFXww+:6f5Z5Z98XdmVMJaGaX3DymS8TXAwED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772328981, "uuid": "88deed8f-06ad-4134-ab55-5a1afa345cce", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772328981, "uuid": "58e3341f-e444-474f-bdaa-41fe60971519", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328981, "uuid": "abd2abcb-832d-403f-80a5-c202c5e1894a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ab4ae7-1583-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772379032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772379032, "uuid": "371d7595-cbef-4990-a428-3016aff4f81d", "comment": "Malware payload (ScarfaceStealer)", "value": "9b88ffc92d7d363757513021f176f388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772379032, "uuid": "84b9981c-23e4-4008-b42d-54ae1dad54ef", "comment": "Malware payload (ScarfaceStealer)", "value": "6c42035513f1246eb3089804910dc9ff8cca1725e6f25c12eff17cb284ac35ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772379032, "uuid": "95247ce9-a74d-4e52-9f9a-a4f663ed0eaf", "comment": "Malware payload (ScarfaceStealer)", "value": "26c5f379400b24b354d86b79f85649f986251d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772379032, "uuid": "9c40761f-9343-4456-b6a8-aa1b7a6e4ab9", "comment": "Malware payload (ScarfaceStealer)", "value": "89be85880075b484c7b2ddc7476f0ca614115c638c881ece02e4e15fb7b91bb012818bc70ee55b9537785bd1f7741c62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772379032, "uuid": "49b81954-5e38-41e3-afe3-6ad729d76301", "value": "T1E4F7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772379032, "uuid": "dda276dd-e612-4f30-91a2-4d6da12b77e8", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772379032, "uuid": "534c34ac-fcfe-4813-b855-17cc9de7a163", "value": "393216:Nn1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/t+:N1XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772379032, "uuid": "0e43c1d6-f016-4ea3-b3c1-59ee6b5c21d0", "value": 71367680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772379032, "uuid": "45ef1f79-c8d7-478f-a0ae-f46f8f721d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772379032, "uuid": "bfb25125-f161-4bca-9f86-181995063dc8", "value": "SecuriteInfo.com.Win64.Evo-gen.33589583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2cffec-150f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772329058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329058, "uuid": "cde13606-8996-4bc1-beb0-6c031d74d5b3", "comment": "Malware payload", "value": "c4dc35ce7548552f53694b22e2d8aa3b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329058, "uuid": "36648910-bf6e-4822-829f-0c6244c72a23", "comment": "Malware payload", "value": "6de34ac1b49f1f6866276063c506c5abfd134432f33baa4469a06b5b8c2c257c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329058, "uuid": "62789e45-8703-4d33-b6c3-11c42aa34896", "comment": "Malware payload", "value": "ce54a05400cb9f0209afb70dc42a25343574d016", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329058, "uuid": "5fdbc389-0235-468c-a119-e554f0037187", "comment": "Malware payload", "value": "3f6b2101c8dc9bb43ef8ea6543b219b2814684930aa21cc658cfd37bf0d86558d7d7e33a2ed700e781ec12f34fdd5f9c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329058, "uuid": "b2ffbfd0-121b-40f9-94e6-0d32e99a9edb", "value": "T1F9F0EB6400E13C2077FD592C50A0960F5177BF33669B3E2871E1CBF49A6BD803159BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329058, "uuid": "428f58fe-bc03-475a-aaff-f9a1e4faa5fc", "value": "12:MquhRnFxvhsxFSJFo6WHdvE6pB0g11YHj6X:MfnnDh06vW9v/7gD6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772329058, "uuid": "e348f500-ec8d-49e8-a990-884d107efd68", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772329058, "uuid": "a37bfc8f-55ac-477b-b8f9-fb8bb365b7de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329058, "uuid": "62eb5a04-f20a-4bb6-8faf-c859c4d1cd37", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85c4f77-1593-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772386069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386069, "uuid": "e965dbfc-fd65-4015-a89b-d5eb71f57605", "comment": "Malware payload (njrat)", "value": "091aa724152a782d33345d0e6a262d9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386069, "uuid": "4b4e5a73-b4f9-4f47-b29d-583fd4dfba7a", "comment": "Malware payload (njrat)", "value": "6ef077339d502b2c4c5fbf6c06a3a512f55f95f42cbbcfcc7620ae47efae7f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386069, "uuid": "bb08343b-41ff-4f01-9a32-71de9d9bceff", "comment": "Malware payload (njrat)", "value": "738d5027135b9b327879681ee11584d61ee82e0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386069, "uuid": "2c6e322a-4dcd-4e25-90a9-4315beaf1c1c", "comment": "Malware payload (njrat)", "value": "471c79c372d0b3804bac037c052477e23e34a5c37a72f59625d29bb3284e9ca6025bd28b52aa30562dc124aa7c6b47f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386069, "uuid": "b8e93844-d387-442e-a63d-fb83eea4787c", "value": "T116B35B4EF7415A98D27C5F7B89A3584942E8CCA77927F37B1DC82DE15F228C8884B970", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386069, "uuid": "cc57eab4-0d23-4780-8032-71cb9f025f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386069, "uuid": "1c00b965-5c99-4e46-9a7d-5754002bbe8a", "value": "1536:29IlnegJvgQKAkUwqXBiv6V0X2ahwn5a5HidryjLM9l1y78R6dewnLGbBk3+eiDT:29IA+vgHbv6uNhr51EP4eWLGbBUXiDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772386069, "uuid": "b5c62f69-4622-4178-ad11-59ff4f4929b3", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772386069, "uuid": "322e0526-7e3f-4a77-adfb-f4cd8ffb93e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386069, "uuid": "46212421-0b83-4767-b92d-5f5eacda9f28", "value": "Velocity.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefe5c40-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396818, "uuid": "4397f4cf-5207-40b1-a6ab-487dc32fc411", "comment": "Malware payload (Mirai)", "value": "1b2df8aad6a011d499ff827734e04da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396818, "uuid": "bcb364a7-a639-47e8-bfd6-3a67eb6bd78a", "comment": "Malware payload (Mirai)", "value": "701f8225216e462ec551ec1b27cc238e2e25799ca563dff19653c3bae91596be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396818, "uuid": "a424a622-7d85-494b-8dd8-82005d6b8512", "comment": "Malware payload (Mirai)", "value": "48b69156bae3bebb1ab4c049c089162f3843d572", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396818, "uuid": "300f33fd-b124-403d-ab29-605ae9c15b00", "comment": "Malware payload (Mirai)", "value": "20673b3b683158a6f76bd287246f1332a060ab7c13028572f009ea0a1c3576cd15ee3ba9c796656adff7e2100ade402f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396818, "uuid": "27e4fb8f-e296-4bac-82bd-c38614f0bf0c", "value": "T1E1F33A06B8C1D4FDC49AC1744FAEE536D932F09C1634B26B37D4AF2E2E5DE205A2DA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396818, "uuid": "8404b46d-2ed5-4aad-907f-94553770fad1", "value": "3072:8J8KTjsCFn14+dj1k5alHliey5cWPMrjYxHisfxJh/kNWS9QLymWrRsz:8J8KTICU+du5Fg4lvSXZrRsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396818, "uuid": "a65710f9-d613-449a-9090-d4309ee84110", "value": 165128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396818, "uuid": "97ac882e-cee4-4822-87b3-1c7dbd09a9ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396818, "uuid": "da3d0aa4-edb8-4d09-91af-9ee541681adb", "value": "csk_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68428ae-1550-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357290, "uuid": "d329853e-dac7-40a8-b6d7-c851598c0901", "comment": "Malware payload (AsyncRAT)", "value": "830bb162328cdf17858c2e097c1ae1c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357290, "uuid": "82c0bf7f-7291-4470-bb16-07280111bce3", "comment": "Malware payload (AsyncRAT)", "value": "70222628c438865777da4a0303fae34cac45ff51731f60cd49df4a6a677cd17a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357290, "uuid": "377041ec-10d2-4d62-bd38-4bbab90bfa65", "comment": "Malware payload (AsyncRAT)", "value": "b8cbba1fb875d4c8342ca9cf1fb17ad6e4557240", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357290, "uuid": "e4f94e3d-adbd-41c7-bdd2-1d16076bf2e0", "comment": "Malware payload (AsyncRAT)", "value": "4364e463fdde119b5a678da4db1b1db41b99aff7355baa094329eeb397c6410939ff6751ca2ce50b9e1dda4e81003a66", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357290, "uuid": "af7e261a-c5fd-4e4e-a2f7-eb589cd49975", "value": "T106F24B0573E58665E1FD1BBD5C3686044376FA478D62DBAE2EC450AE2A237C8CF14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357290, "uuid": "6dac42ac-74f6-4c25-9397-f10256d41ffc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357290, "uuid": "bfa19342-7454-4f10-88cc-56195ad40ae9", "value": "384:sMThv6M1S/y1IfbwhOlE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCzZWW6EN:sihvbI/y1Dhx1hV4RbJwB+WW81Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357290, "uuid": "014d9f86-8a9a-4b89-b380-6b99b2ff90ce", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357290, "uuid": "1de4907b-f90c-4522-84cb-50fdfbfa3482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357290, "uuid": "f5630d56-213c-41f4-904d-3c1a5a75d69c", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0d2d35-1565-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772366213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366213, "uuid": "52e8eb17-b20a-4df6-867c-f398af256a65", "comment": "Malware payload (ACRStealer)", "value": "d64d34892f5731688fc0825f38bff57d", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366213, "uuid": "c9824075-819f-4762-8ce3-3be3ac790eaa", "comment": "Malware payload (ACRStealer)", "value": "726a8b7b87c7aab20c1e204aac06c71cadc8320fd9338cdd61af0e4f5d3a8b01", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366213, "uuid": "ff8b10a3-b2bb-43e4-888d-35ed1770b185", "comment": "Malware payload (ACRStealer)", "value": "a02ff9674040ff9f70c6d832bac4ebc0607e717b", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366213, "uuid": "37fe5c20-669e-4de8-b7b7-6d4cbcf0e966", "comment": "Malware payload (ACRStealer)", "value": "a56c40630cd29c2499d34f21b44b25f10617f4626a04ad0c5cf59c7290fbade4c62f16710de901c9100f3f6c34d0ab04", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366213, "uuid": "3259f09b-a058-41e4-ab90-f6f4c441b40a", "value": "T198F63320AB6916E7E3F6713EB6319107A450B2F8D913FE8F758CC0E746C3BE19226951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366213, "uuid": "89e62dd5-1c7f-465a-9d54-becc4f68898d", "value": "393216:50aia+q9CHothqgoIidJwAwNFzF3XUyYjdh/r7bs1dQnSO5Y:KY+q90obxL2/wt3XBo/r0DQSO5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366213, "uuid": "4ec6e84d-2b15-48d2-a9f7-d849d6705a4b", "value": 16200438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366213, "uuid": "cb45355f-2735-40ce-8fe9-c161561dd749", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366213, "uuid": "629dd820-eb12-419b-88f6-c0d56cbf1b44", "value": "of.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ea3468-1551-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357426, "uuid": "bbfef1d9-26c2-49c2-bc40-e4002c6a06f2", "comment": "Malware payload", "value": "bc75d7986f8766b0a1a14fd42ffd2b2d", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357426, "uuid": "7f0e8be3-2c02-45a1-a5cc-c1ce499f7f3e", "comment": "Malware payload", "value": "729cee15bc1891fd5d8a9fe8ed1d74aa0a65549555f086ee9d88588d70b0b53c", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357426, "uuid": "1f31163c-e710-4e45-bd53-af71d11a0794", "comment": "Malware payload", "value": "65f084d4c5149bbb8811e2b34c4b75171cdc7b72", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357426, "uuid": "639df924-01b8-4be3-aa79-6eeab6a024b2", "comment": "Malware payload", "value": "1456c8e9530c9d73847f65473abcb07d0df7876c51259ce90d1cd0514d4a1df90e0bc06f7129469f7451cf48810f6279", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357426, "uuid": "a4b0f2b7-42de-4b78-a98c-51df4b6b4fcd", "value": "T122F5BE11F3D48A61D52A9638CA67C733D671FA418334C68F166AD61E2F33B918E3B724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357426, "uuid": "e3c0b7c8-aa85-415b-bda4-bd83f1cd2f4c", "value": "17702ed66bbbb38da685a4e5113c9b59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357426, "uuid": "ad184f8c-041a-45ba-ad68-03c3ad1aba06", "value": "49152:+fg1q0O1BE1Bol4c82zMv+1+mYlhhWHgMzSpRRscrX5y4iwZTbmnrZv:LrO1bzMv+1+jvRRNhnZTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357426, "uuid": "0c31977f-bca3-4528-b90c-c6dd28102399", "value": 3347968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357426, "uuid": "365cb4fa-0758-49e4-92d3-f23260cd4668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357426, "uuid": "46dc9965-04af-4dac-a65a-b583a040cc2d", "value": "729cee15bc1891fd5d8a9fe8ed1d74aa0a65549555f086ee9d88588d70b0b53c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d649cc1-1556-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772359529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359529, "uuid": "b0d93b9c-5fdf-4738-bf99-53598ddbeafb", "comment": "Malware payload", "value": "048fd77e9087678e488353242d2cd73d", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359529, "uuid": "ca7dae25-45d0-40be-9871-bd95224a9038", "comment": "Malware payload", "value": "72fb9a8fb8ec1ed4d1000a596b18ccb59f34402f73b47175566e37fa81ef8a41", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359529, "uuid": "8e3e9c42-2c14-4aaf-8fbf-f0a34c375007", "comment": "Malware payload", "value": "2d6550d8448d2e06ef51dc10fdabe1cd8cf9e3e9", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359529, "uuid": "3ed54566-8ac1-4714-98e4-66b32a693706", "comment": "Malware payload", "value": "475d97010774f72e3c95c4570cefa05f5d6c594c8267d1a10e5886a9ee1593bce730ae8f0c36305cc03b61cdb06a3819", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359529, "uuid": "f23efb04-eba9-4c37-9664-34e56ce6a008", "value": "T11B863391E3D60EFC935A065870CACA8988374E6D7819DCACEB36F1074A37D1E8895DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359529, "uuid": "d7894fa5-8660-4849-a698-f2bf914983a5", "value": "98304:uZWKE3hhdbDOG2gzR6/08YBXs1Wr4j1/k+YcrA9qgdUbE4oymLnt3ymzmriHefQ7:3FZ2gzRrco4j1l7rjY0mzmrsZYvyDFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772359529, "uuid": "3d012eaa-75a2-4dba-80ea-9e9ddd328d37", "value": 8194678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772359529, "uuid": "291df1da-3e5e-4d42-8d47-2d696e0c7be1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359529, "uuid": "1615ad51-5860-488c-b13a-c94c39a864ef", "value": "e654df84fd6dc02ca1b312ff856ef2ca88b42a72bab31ea3168965cb946cf16e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97089e25-156e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772370014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370014, "uuid": "4d984de9-1dda-4722-a3bc-1195144d7038", "comment": "Malware payload (AsyncRAT)", "value": "90f65957761b350484765b22417c3ab5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370014, "uuid": "6390f46a-241d-400f-bd70-6c2da6ebca19", "comment": "Malware payload (AsyncRAT)", "value": "74a5f11930bda9acd1b95b609629a65c8752fc38a5e540973c36904a83b8272e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370014, "uuid": "1c69ba5b-1f30-4848-8caa-cca9cf5942df", "comment": "Malware payload (AsyncRAT)", "value": "23622bc70ad41ef1222e0bc93d4f4ef7d5241b2f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370014, "uuid": "f3263ee2-30fb-4910-ad92-269f8ba4c086", "comment": "Malware payload (AsyncRAT)", "value": "873b1e9fa93e585355d48221e62aa68ade385acdb66ae68f7fd8a7085a7c3a2a75352e90f6b7c1ba36d5e6f152cb3bf9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370014, "uuid": "d790472e-4282-43b4-aa02-0456acbb61b8", "value": "T174F24A0573E59665E1FD5BBD5C3686044372FA474D22DBAE2EC490AE2A237C8CF14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370014, "uuid": "a0134ddf-5d97-4fd9-a4e4-4860bba2ccce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370014, "uuid": "57b85788-78cb-44b6-a4cb-50bb9bfb562c", "value": "384:7MTZ6h+13LoBsoyyzuhElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCcFWW1:7iZ6UeBsoyyahT1hV4RbJwB+WWnHQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370014, "uuid": "cc55f39a-9628-4aab-adfe-b70558c86d88", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370014, "uuid": "f75fff94-dd8b-4539-be8f-cec543ac8b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370014, "uuid": "2d6a894f-73d6-4c65-bf0f-f2f4bb372a97", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91f179f-1599-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772388647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772388647, "uuid": "bbe1b250-9919-4919-809e-07b6c92d07a8", "comment": "Malware payload (AsyncRAT)", "value": "2615cb5f93b2f8ee147afea62249f597", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772388647, "uuid": "abd7ce55-25be-46a9-b17b-280fe87ddc3f", "comment": "Malware payload (AsyncRAT)", "value": "74f095f2b5f575720fa634777740f4856468a0c008ba8e78b2d53738b205dc46", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772388647, "uuid": "ed1a08f2-5ef1-4b7a-b433-3d52369599d2", "comment": "Malware payload (AsyncRAT)", "value": "d3c3deb7e8b7a747a46e38908413514e5c43c31d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772388647, "uuid": "243fbbdb-82a0-454c-9443-f95a9421d2ae", "comment": "Malware payload (AsyncRAT)", "value": "12541abc5f961b3a229b9bb1b45a0e3d6460e0953661797bba5b9925803969e8fa5991abceb908ccb2e5061cbba9f158", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772388647, "uuid": "0f80621b-efc7-4a99-a022-605f54cc43bb", "value": "T15AE6F08D9A1256E7D8AB6BB58C5183467295BD063FE5F7C33A2060241EB32DC5C3AFC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772388647, "uuid": "aecbce06-a625-409d-ae1e-62782e4e1a4f", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772388647, "uuid": "16521404-ac0e-45ce-bcc2-29cb98d64b47", "value": "393216:FN/xstQ/ySftN5i2TgGOzzeKZC/MjT/a:FlxstQ/ySfv5i2REzeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772388647, "uuid": "a708bcb6-fc00-466f-b87b-e785c5b1ce2d", "value": 14484992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772388647, "uuid": "8cec7577-8720-4f46-8397-2b054dc00c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772388647, "uuid": "f61e305d-261b-4425-aa3a-3c50c6e14e64", "value": "test201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abced5f-159c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772389536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389536, "uuid": "c182900d-3def-4ef7-893d-286c8a10dda0", "comment": "Malware payload (Mirai)", "value": "f9ea9088c2ad87e9150e7d1aba17f37c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389536, "uuid": "a7d5282d-6690-4979-917d-d4acdef879c8", "comment": "Malware payload (Mirai)", "value": "751088a2c57f01b5204a7423c28afeb974729303019b24932e97a01f7800b070", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389536, "uuid": "465304a9-a949-4d65-92ff-23bd071d3170", "comment": "Malware payload (Mirai)", "value": "159e2a55dc44594548c7be2c482ecbb1ca023d2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389536, "uuid": "dbaa4bcf-be0f-4380-9b8a-3e50f9ad359c", "comment": "Malware payload (Mirai)", "value": "c80678c2540803809a2040dfdbd201edbf9b71dfbd166cd4aae13abce50f36147003899d498e4877bd131c8832e13fb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389536, "uuid": "57de00b5-6139-4e02-b716-d19961cc688e", "value": "T1BC868D59FD0F3851F3DAE37C9F8AC7E1B22B75A0D26380B33992424CD196AD9C6B1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389536, "uuid": "3ff8a2d5-298b-4874-ae81-b3f026104e90", "value": "196608:9gMYBtU0Jx2azmqoajfG3wOe+fFtHlL28:aptU+2az4ayDe+fFRx28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772389536, "uuid": "1ee79120-42a3-4412-a0d2-398370fc2538", "value": 8236456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772389536, "uuid": "70de971a-eccf-4329-8c3f-78b018804264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389536, "uuid": "9cdda366-281c-45a0-b739-266457cc1e78", "value": "fullgc-linux-aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3e343b-1572-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772371880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371880, "uuid": "f1d422a9-e980-400d-9beb-9ae248c54770", "comment": "Malware payload (Vidar)", "value": "4bdf8c05619f4ade2cf6390cc41d07b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371880, "uuid": "2a3ad2a1-3f38-44a9-bc7f-d34b14993de8", "comment": "Malware payload (Vidar)", "value": "787592603ffa9a1a64d1d56d39d26a72a5bf45a15151c44fe152e79acd128878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371880, "uuid": "1d8c8688-1c91-4227-aef4-883cdd6ba0b5", "comment": "Malware payload (Vidar)", "value": "b1b3db4254db644fd546d97566793178a59f8cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371880, "uuid": "b183a788-070b-427b-abec-4eb14f4654b5", "comment": "Malware payload (Vidar)", "value": "4678f13edf3e8d34bfd22e9a4c8c59dca8b6149ae5d16c34f369ad67925468c7fdc010b3730bf0c1a134cc956d9431c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371880, "uuid": "34141923-a15c-4df3-9028-d6308868d2ed", "value": "T11CE6E67F66E18569C11D823AC0B28B0DE4F363BD0773DEE792A403681A565F05F7A62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371880, "uuid": "18c25150-a0c1-4b33-a200-0b596fe25e67", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371880, "uuid": "93607337-efbe-4b5c-9a2f-933a00bd406f", "value": "98304:GfbvYfLRXJbWCnIpjJd/8+pGehoKcdQI:GfbvMXKocx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772371880, "uuid": "c9adbab3-9559-42c5-9026-026c5b41a95b", "value": 14013952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772371880, "uuid": "72cb88f9-bcd7-4238-ad47-c4dffe23a005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371880, "uuid": "64ab09c2-3af9-4f42-bc5c-9f8bc0245b41", "value": "SecuriteInfo.com.Win64.Evo-gen.87944272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1d116e-1554-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772358888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772358888, "uuid": "403b69e1-6dd3-4882-8ac3-c96ebca88911", "comment": "Malware payload (Vidar)", "value": "22604d61e9efb76fb10af6d488ea458a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772358888, "uuid": "4170a873-c89e-4ee3-a55b-0333a56d2ab5", "comment": "Malware payload (Vidar)", "value": "7a87b8766e893623d7528f6fa9b634b8219620bd12c7afd72a9c2badb8d50d53", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772358888, "uuid": "40fbbf89-b8ca-40e1-b928-def178af276c", "comment": "Malware payload (Vidar)", "value": "c91be812dfc47a9441ff8abc2109082519898c52", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772358888, "uuid": "6f28905d-67e9-4dad-af0a-5b50560fb380", "comment": "Malware payload (Vidar)", "value": "643a9b1419f5102657d169940a5a2333e035c8520572a5ba3cfab484b08025b645fe0a27199b3df53813b19a619229b3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772358888, "uuid": "1f7a99d3-a6ed-4715-a7f5-7e3e08a80aec", "value": "T1E196D33B63648269C32D913AFCA38B00B9F370B90726F6E7559D1F596E519C0CD3AE24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772358888, "uuid": "47a9ac72-4bdb-4952-952d-c524cbb8b426", "value": "2549ebf941b5f40c69593fdeea32a946", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772358888, "uuid": "4f519da6-4930-4374-94dc-9e4619094b3e", "value": "49152:na6jgnfQVCpf+DYEuUmK1N0TqUacS1+UySCFLgpoQB5sIR6l3x96WoeopFN4XgEk:nSwUK/xaHoeojNEjPjqI+y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772358888, "uuid": "d9f10ace-de13-4955-b118-3ca8a6e5b977", "value": 9328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772358888, "uuid": "11327630-c4b4-48e9-80f2-edba8b03b8b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772358888, "uuid": "706b60dc-569b-438a-b4ba-760753f7ee39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce7bea9-1568-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772367555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367555, "uuid": "aa760ad3-fb84-42a6-8d5b-33eac6f238a3", "comment": "Malware payload (ACRStealer)", "value": "c060664821f70bb0406ac6591943a6e8", "object_relation": "md5", "Tag": [ { "name": "146-103-104-188", "colour": "#6EEE8E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367555, "uuid": "bd242efd-4568-45aa-be96-942ca5530e61", "comment": "Malware payload (ACRStealer)", "value": "7b56bf129830c3a1545910ffb3acb0e4e0307aa53ec01b258eacd831fcaab71f", "object_relation": "sha256", "Tag": [ { "name": "146-103-104-188", "colour": "#6EEE8E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367555, "uuid": "19ec6710-9b9f-4e0a-9d38-942dde7d7fe7", "comment": "Malware payload (ACRStealer)", "value": "e15f5c085bcca35e56dc27608cd2c923953948a4", "object_relation": "sha1", "Tag": [ { "name": "146-103-104-188", "colour": "#6EEE8E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367555, "uuid": "e0c5db13-f922-4c76-9f3c-8f725a827c98", "comment": "Malware payload (ACRStealer)", "value": "96e3f96899d08eaffe1c3461b074ec92abe7c69606ddb6307720c720d63950758d69c30f51945694f685d75c1eec57b8", "object_relation": "sha3-384", "Tag": [ { "name": "146-103-104-188", "colour": "#6EEE8E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367555, "uuid": "0d7d42e8-4030-4d00-99a9-1feec1277733", "value": "T135D68E239DD08274F5C651FE86FD3B6AC96D8A05033991C399C83C985B319E63A3E74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367555, "uuid": "1b3b0e9a-ece7-44e8-8512-442a3e27456c", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367555, "uuid": "493a319e-5c89-4193-8b95-e922dd02080b", "value": "98304:kQgZdW5JUmAExyHoAQetMx/Yx2i7QGlve/h/xDt/0hNZslJ+FBoY56vdSnu1hSyp:kQke5A05AXFN3delxDtPAFGfcn+hr7mE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367555, "uuid": "e227502d-0e71-48c3-8f99-985613af2e66", "value": 12666088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367555, "uuid": "89531e8b-10c5-452b-a8ec-b4a9c8d1710d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367555, "uuid": "15f6790d-f802-4724-832e-402a727d1861", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d2d8f5-1561-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772364191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364191, "uuid": "face5907-731d-45b0-9e46-5729600844a9", "comment": "Malware payload (Vidar)", "value": "257620b85b1625425fbcfb25d1e14d33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364191, "uuid": "0506eda9-4d65-45f6-9b45-db179a9592d0", "comment": "Malware payload (Vidar)", "value": "7c7c5189cb237b205bc5192294d1a2b64c8bd543d218bbedba363956777fb7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364191, "uuid": "679d70ec-214f-4307-b44e-ef9cbe012fb9", "comment": "Malware payload (Vidar)", "value": "e993d31457f53a3b5a68355ab534271469e18692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364191, "uuid": "1074b2df-ee1d-4261-8d2b-6d127fbecd63", "comment": "Malware payload (Vidar)", "value": "bc3a06cb5ab84b9f95bf601d7bc711de8666598e10e30880099d48bc5a484300f040d31e5b656887150d237bf782b8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364191, "uuid": "974d2fd0-70d6-483a-a8c2-d11ae81f2a67", "value": "T1C2E6F66B7665BD69C21D823AC0B3BF04E4F370B90722C6E783A0076B1E565D45F7A62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364191, "uuid": "9c091d70-307f-4249-9057-4e348367aab8", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364191, "uuid": "1281b203-0bac-44d3-9f95-750b4af82366", "value": "98304:VfbvYfLRXJbWCnIkjJd/8+pmjrxa1bSCdQI:VfbvMXbocsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772364191, "uuid": "921b0457-fdab-4a00-b435-9207bb357bd9", "value": 13965824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772364191, "uuid": "15496b79-de4e-4094-b118-2c58d8681db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364191, "uuid": "228274cd-e179-4b23-a1fa-85177e7c4b3d", "value": "SecuriteInfo.com.W64.Agent.AKO.tr.12146.29245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eed662e-1580-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772377598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772377598, "uuid": "38053a5f-be8a-4cb9-ac8b-6c3f2642001e", "comment": "Malware payload (SalatStealer)", "value": "16ad3e6531764b8d3193547cd5c6dde6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infistealer", "colour": "#874F1D", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772377598, "uuid": "ed19419d-065d-49f4-9714-b08b37c6cf76", "comment": "Malware payload (SalatStealer)", "value": "7c99023596af9048bbfb4d44f629950e35e7c94fab6b29324586125aa7489674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infistealer", "colour": "#874F1D", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772377598, "uuid": "e1bde2b8-dbea-4893-941a-0b6033d24965", "comment": "Malware payload (SalatStealer)", "value": "1731aff24cb8cb743215614b9ffe503c63b20f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infistealer", "colour": "#874F1D", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772377598, "uuid": "b80ccbc6-8de3-4e02-9ccf-cd0ab7256a8f", "comment": "Malware payload (SalatStealer)", "value": "879a261bdc7c2e8dd96a47641e4469c6fbc22f85ef7bd2fdbb00dfaff42057390c382beaf3b4b4ce7548ac2f073a24dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infistealer", "colour": "#874F1D", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772377598, "uuid": "24022d33-c80e-4471-9dc0-634b1db273d4", "value": "T17307339863A800D9F99DF73DD5C094A387E2B02A17A5C28367F88D540E236D5FF71792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772377598, "uuid": "0366ada4-7a4b-464d-b873-c920e361cb5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772377598, "uuid": "3ea15807-e90f-4389-9e4e-f1edbf208606", "value": "393216:DddqsI5oWy2wAuEW8ZzHt8vTcmuEHt8vTc8XsWAq4tHhg:B2qb2zW8ht8vTc78t8vTc4wHhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772377598, "uuid": "eedd80cd-fb7f-4d30-92bd-f54216cb3e71", "value": 17263104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772377598, "uuid": "7b542fe4-ca58-4dc6-a741-aada16b8acb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772377598, "uuid": "c5c2cddc-1049-4684-b2ae-d50bb31a0aa1", "value": "RkFix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a187ba17-158b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772382487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382487, "uuid": "0e00c8b6-13bb-4b1f-9914-e6ce9f831303", "comment": "Malware payload", "value": "104dacb3a11dd1a1023f3c2c4a154ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382487, "uuid": "4d1b27a5-ea68-4289-9e05-aec8bdadb43c", "comment": "Malware payload", "value": "7e4950346f390c0cceb4e7e54b5e6227d42fabb7313444fdd3e364319c8286c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382487, "uuid": "e0384438-64f8-4c02-8fc3-9ec6dff24568", "comment": "Malware payload", "value": "4ea0b28e1284df12cf3f09bc808f545f81f052ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382487, "uuid": "1071a3e8-3401-4183-b083-02f79a045255", "comment": "Malware payload", "value": "48fbdc459e3f01198b1a6c4eac0e2a5ea00f2a204b8661f6405384acf8ac127dd273c1050194c55a50694ada91370d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382487, "uuid": "99279945-483c-4aad-8bbd-5d7dd8ff3a76", "value": "T1B208336181E1081BE073947A9572CB748A665C969706C3F78ADCAE877E271C3BC3DBC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382487, "uuid": "7b0130b1-7278-4c5a-bf68-753e49e17cb9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382487, "uuid": "dcff9253-e3f9-4406-a52c-4ac2ff1bb1a2", "value": "1572864:cfjqEis/8+VPyAiF5R7mP9daWnp+AJvZlxq7OW7/Eoc2PGEz:qws/fV0lm/lIAJvZlk7p/nhP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772382487, "uuid": "efe7eee2-198a-4386-a2cd-4dd50526c53e", "value": 77176419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772382487, "uuid": "ed18989a-b71a-4a00-8c21-dce3fc29026f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382487, "uuid": "a748692c-e924-4e2e-bff4-86751a5de483", "value": "NewLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486ca392-1587-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772380620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772380620, "uuid": "e2f49599-bd73-4f99-928c-58cfa0c55924", "comment": "Malware payload", "value": "2389f0f778553ffcff8dfeac35e98066", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772380620, "uuid": "060e299f-3d94-4631-899e-b201248e0f4b", "comment": "Malware payload", "value": "7f21d4fc92774e7541df31911a565b5593bb1ec244443be4a14b290258f672fb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772380620, "uuid": "a9fd1ff6-56f1-4c94-af89-c8763d4131f0", "comment": "Malware payload", "value": "73ec61914f587c78f1133f9ba5372e199788cda2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772380620, "uuid": "5472f89a-e9ad-4a88-a67d-db4e690f40e8", "comment": "Malware payload", "value": "92b45bb562c6a8b59cc17324c696e93f63e9d3de6ab91d277c1f31b1cf41c41a947b71bffc3bf6e5827c4c3ba38975a7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772380620, "uuid": "230a47a2-0bb1-4ee5-8a41-38b4a6f7288f", "value": "T143570219D25F403ACA57D67928EF4BE6FF34869B8320571F23F439198CD2B890B22759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772380620, "uuid": "3509138b-28af-4d29-a217-d21ef129d27d", "value": "786432:LDNcLQGN5q+feL1rC8Mk4CrpPXjstm97IDEz0t:LDNccY55eLVC8MkDtPXWu7I4z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772380620, "uuid": "c4aee2ac-fd11-4aea-94c3-301805acb5a9", "value": 29526308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772380620, "uuid": "e6e68201-2c6c-4f67-81a7-3b5ff4fb88c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772380620, "uuid": "b5eaefe3-4fb6-4ff2-84f4-1dfd2458f4bd", "value": "system.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472d7e48-157e-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772376752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376752, "uuid": "8c17b876-bf2d-4e9f-b300-d41597ac1282", "comment": "Malware payload (SalatStealer)", "value": "fd6e82e3cadfb25544952eca95ee0c6b", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376752, "uuid": "331e4dea-6930-4870-81f9-fa1e05a42d14", "comment": "Malware payload (SalatStealer)", "value": "7fdecc456a601dc61d8f0f75f44af834f8d1ebaf268f614231c56ba72ed4ea9f", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376752, "uuid": "fb758f35-b137-4deb-b65e-9b84429bb02c", "comment": "Malware payload (SalatStealer)", "value": "38d12aa7490b230f356039d1a4a57b5b28bcf953", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376752, "uuid": "c653fdbd-899c-48ac-9a02-33491cefad1b", "comment": "Malware payload (SalatStealer)", "value": "7944b3c020c3c29d1f361ef9f5f482e843f913db03ef2ae8a045178924d5d77343bd3290e9eb3a4871c1b53a0f352910", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376752, "uuid": "c71bf3c3-bbb7-4e92-85b1-392c0786153c", "value": "T1A01633442FB009E4D2FE473806F126327F71B6531B16EF6E179AC02EAE211928F15F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376752, "uuid": "4e999d81-8f80-42f2-8648-54f35baf7ee4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376752, "uuid": "cb48c908-9848-48d8-a876-64ff96052274", "value": "49152:LxjxWQDC6I+jUUJ0QendX/Jgq1M478QIvL4SlrURTPugrXb6dgNaKg52e0vrzwXL:Jwlq251SvcSVURFLudIaR2eUgmr5WgFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376752, "uuid": "6ac71019-3738-4a63-ba63-1011c4d2d1e8", "value": 4068975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376752, "uuid": "acc57e2f-78f6-40cb-8614-c1e718ab4e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376752, "uuid": "2fc663bb-1c72-4f3e-9031-3da652d6043f", "value": "Discord Fix 2.0 by Sexsoldier.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc6628a-158a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772382082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382082, "uuid": "a8452981-9d14-48c2-9609-27771c27a41c", "comment": "Malware payload", "value": "bdbc76829359f2f304c944099575dea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382082, "uuid": "08bbb91b-a84e-462d-9518-b74b057361aa", "comment": "Malware payload", "value": "8011996692048501c1eccb66a2771546ade084806f48994104d199e28af82a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382082, "uuid": "de992b26-ed76-4580-a1e5-98ef76833329", "comment": "Malware payload", "value": "03946d5837bfab1b99d41d924f7e309335aa90a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382082, "uuid": "7d1c79e9-f7d2-4936-9e25-9d41811e5248", "comment": "Malware payload", "value": "88e99511a0029dac4707931a45c1df55fb19ca973622bde34e264784cb7d6ee5979543714cfa65328040d3ba1b72d284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382082, "uuid": "a1175d04-d78b-4812-813a-0c78ceb9dec0", "value": "T1BFF31903E68660FCD466C57856969132F673BC620B22A9EF17905B352E71FC0BB3CB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382082, "uuid": "cc5e4035-db4e-4030-ae33-4366ae5e3bcb", "value": "0b239b2e24f947e6eb7cac795d0de7ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382082, "uuid": "d3da9b02-8ddc-4ef8-a553-9f55c02ef2c5", "value": "3072:umfu6RT6Crpqs7MMiI4SnSbBe8lnSkz7nbBBh3vpbkJNdEtGZtEKkxDRlS:/u6RpqHMixdpljxpbgNdEtGZtE1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772382082, "uuid": "d28026cd-ad6a-4ac0-adbe-5afe9721f418", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772382082, "uuid": "81a53e17-c36a-4b6d-b5bc-ed3a9fbc555d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382082, "uuid": "5789b1bf-21e6-4ffc-ae94-f71dc9259b6f", "value": "Fixit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25115dd-15a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772394542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394542, "uuid": "308b2b6b-f0c9-4348-8894-4950703aa900", "comment": "Malware payload", "value": "dadec156a03c94937d7da68f49af88d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394542, "uuid": "68725f41-ccb1-43b9-879d-d3b091ca2bda", "comment": "Malware payload", "value": "824b993b9e8acd57402a094e85d72bc737e1b7bd943d3a281329068a0a8e9375", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394542, "uuid": "90591da8-6c22-497c-9d87-ff2058eaf89c", "comment": "Malware payload", "value": "fae12a4e9d106bfbc986805320483ee8aa82105b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394542, "uuid": "56a416e7-aeec-4fd4-99cc-3201a85e2066", "comment": "Malware payload", "value": "b496e6f83687bb25623b1835aae78b35528c8349bdaa7ed30eeae8221d285225855a5e6af019d74aa0f516821723861d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394542, "uuid": "56255bce-2a33-4922-b510-ff570402708e", "value": "T1FBF30946F8818B15D5D251BAFF0E128E37131B78E3DE73029D246F347B8A8AB0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394542, "uuid": "38779cea-0a56-4050-ab3b-aa55b21948a3", "value": "3072:RpEyR4kf3o5UAEjF0CofKaa2F0Y1c6FxMZA+zabsQkWgot:HEO4kbJxEftaKJ1crZz+3kWFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772394542, "uuid": "9df5efa8-5e84-4d51-a7da-3a76400b54da", "value": 167420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772394542, "uuid": "8cf0ba67-4a3b-465c-ba08-94c86f6fb2b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394542, "uuid": "61b2740c-0711-4d5d-b874-86dcf93e5605", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedd4b48-1561-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772364525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364525, "uuid": "f9a48e09-a598-43af-ac54-fecd5586b143", "comment": "Malware payload (AsyncRAT)", "value": "9446a88892488d2969cd17c43dcf7b8e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364525, "uuid": "2ac650f2-57ad-41b8-a9e6-43f2a6e9e8d6", "comment": "Malware payload (AsyncRAT)", "value": "846e8f0d464baf23639b8fcd25a11a460afc787f1dbd5c0f30c254f72a055817", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364525, "uuid": "4db219f7-ce6e-444a-b824-ec28ce543818", "comment": "Malware payload (AsyncRAT)", "value": "9bbeac6e0e636ccd88d29a283fcfe8d43a2bf0cd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364525, "uuid": "b22fac7d-0ffb-4ecd-adb9-1baf70a9c63f", "comment": "Malware payload (AsyncRAT)", "value": "fb7b35a831522fd66e4cee78e1c08ecaa353d72b31bcc3ea42cd8317badee620c3fd86e9d6dcc271c07f466ae99d7aae", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364525, "uuid": "25069f1f-48d5-4610-9fc2-a77d9ace9ffb", "value": "T198F24A0573E58665E1FD4BBD5C3686044376EA474D62DBAE2EC450AE2A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364525, "uuid": "32e3a646-16ac-44c2-b938-031c7acad99e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364525, "uuid": "ad91e1ce-a05d-415a-b0f3-862ae4311e72", "value": "384:QMTh22Q1RzOtaf0hOlE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCa+WW3EQ+:Qih2rbzOta8hx1hV4RbJwB+WWOMQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772364525, "uuid": "168d874e-f3e6-47c6-8a58-6828041e3df7", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772364525, "uuid": "753d0732-50ac-4e0f-8448-579697ec6afc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364525, "uuid": "7ceef142-56ca-4a2c-8643-2fbe21f540f4", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d206faf0-150f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772329311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329311, "uuid": "12cdd7b2-4762-4f6b-9ce6-6bf68b0fec6f", "comment": "Malware payload (Mirai)", "value": "5c09f30c38777dfaddf69ae622adb635", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329311, "uuid": "960e44ea-1dc0-4202-bcfe-f2080fa8921f", "comment": "Malware payload (Mirai)", "value": "84bd3233c6936ee6a54f702a80bc224fc504c46dc64a178f72dd1cc7fab4fe26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329311, "uuid": "38dd9c8d-f35c-42ba-8d2d-4cecd41e20b3", "comment": "Malware payload (Mirai)", "value": "1772f88a271f0331173e3803eeea0b690b6cf331", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329311, "uuid": "77039536-8ccf-416c-8e7c-9917b6467479", "comment": "Malware payload (Mirai)", "value": "deb6c4061f1f8e9ad155f0c7248d2cb1fff3857682d7b55f6f7577212a8ee81049a02f161d728275936ce48e75df89f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329311, "uuid": "4359072d-08a4-46a7-a301-a436384c9792", "value": "T14C031991F9819A17C5D11572FB4D418D7B1AA328E3EF3302DA295F61378FA960F3BA04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329311, "uuid": "cddf02f5-8e7b-45e0-9fb3-6e5fd6c73ddd", "value": "768:zmj/b8tM3aL8U6FlwIfBx8ooeu8YmMjTw04/x5OyaF1ZRfKI:qjP3aJ6F/Ijm5MtFVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772329311, "uuid": "2f90e65a-49ce-44fe-bfce-7b84feb99b8a", "value": 40908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772329311, "uuid": "aa332bf6-a42e-4d13-9ede-4c7b3bd16018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329311, "uuid": "68619e39-6d59-4223-8469-c97dd28aeda9", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca15412-1508-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772326162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772326162, "uuid": "b7064f81-85a0-4931-b659-4fba0e42660a", "comment": "Malware payload", "value": "f9680b68db8a94bcbeee9ef1bea02c14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772326162, "uuid": "1fb1dc7b-ed61-44dc-b6a7-437b45701201", "comment": "Malware payload", "value": "84f8095c47271d90804d84b55ef4d9ca29b99da0fe192f6a4f819ae5c2e12f75", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772326162, "uuid": "0843242c-3fc8-4749-bfd4-8d52d7b26a3d", "comment": "Malware payload", "value": "0dfb4a242ee69ad1e694916a4ab86356ecce4f7d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772326162, "uuid": "d3f2fe0a-3478-4dbd-aeed-dcfc0479c6a7", "comment": "Malware payload", "value": "308e84f043eb9aac6a381270507b50871dbd03f2ab0d090a87ece7ad3a01a1df5654539cffe1fbf6b326d03560d4e753", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772326162, "uuid": "3b0b6705-d790-4f2e-831e-a08fced2db83", "value": "T13FF5F6F4F2754866EB4D82F0C068F9F9C9282DDA1B1212DB745CB81D72FB68D8C249D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772326162, "uuid": "fe0ff056-b98b-498b-88e7-f2d2083aedc2", "value": "24576:b/3o1k6/c9qGgoZ7gN8aS+SOxhJmjl/hkI/pUN0xN6RALJhCZFcDZyiyoPEYfz+u:zoy6UK+tyezLJhCdEdhnMg1KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772326162, "uuid": "faac587c-0038-4ce4-b986-fb2bb106b425", "value": 3421816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772326162, "uuid": "3c190285-968b-4316-871c-866a36ec612f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772326162, "uuid": "f1890d2f-2eb9-4501-9b5e-1b75f44313c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df677f08-156c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772369277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369277, "uuid": "35a4451e-9a55-4013-b59a-64c99155e172", "comment": "Malware payload (Vidar)", "value": "adbda09ae3d6498d873ab8cdc506be47", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369277, "uuid": "db916194-8793-4316-8e0a-74e4e941f373", "comment": "Malware payload (Vidar)", "value": "85cb531d4ddc42396549ec4b0aab8217def469240386a4f249a0d81c5ed622d7", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369277, "uuid": "1f823dc1-4558-4d4c-a79d-a7738110739d", "comment": "Malware payload (Vidar)", "value": "ee8fadac6d4318221150020c1022863a164a97c8", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369277, "uuid": "3ba4819d-a334-4eb4-b0fa-55ed9e628cdf", "comment": "Malware payload (Vidar)", "value": "cbb0d4627f6007aa7f9ea1c52ddc291b803c3a60b19a19438610266104644428bc0d1dc3ded0da3f8789cfee56d9c3dc", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1212", "colour": "#CF7668", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369277, "uuid": "5a182d5d-0d9d-4113-b1af-7ef6a1231ac8", "value": "T195273391EFA4ED5BF32E2104507313FE398863CD689823F2C74C65E1BA9E276D589C19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369277, "uuid": "e68fe105-e5af-481f-892e-f4264bbc0463", "value": "393216:kc2xRcpC8FQnUe+uqvT0kEioeJX9P8sVAMWbg2d8aVgaFWiYUmUUiHJx:aRcpNFQt+zCeJt0CJqgOW7UmUUiHJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369277, "uuid": "b7384494-d501-4deb-b775-bcdb36ca2f14", "value": 20711870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369277, "uuid": "09805691-03d8-4ba5-9d2f-1902f7474a3d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369277, "uuid": "3ad486e7-d22e-4923-ba2f-492491a0310a", "value": "lnstaIler.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeff699a-154e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356311, "uuid": "c2faf030-7302-4737-ae94-f9c73f040cc3", "comment": "Malware payload", "value": "675a3df149890984bf60b1115f6acb80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356311, "uuid": "878bfae7-58fd-43aa-a496-2d4e6399646e", "comment": "Malware payload", "value": "85f9f98d4558996f9e45e945ba6347d6beea0745c66c223da39bcf1d46b3c42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356311, "uuid": "6d97a72f-252a-49a0-b70d-5e9c3682b634", "comment": "Malware payload", "value": "48eece4b8d0e81988247885d0463ac2c85767d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356311, "uuid": "7bf387eb-8ea9-4fa4-8ec6-289b477d1db6", "comment": "Malware payload", "value": "1e6ad3cc46441a2d8c87af2661c6bbaf380310ff24fcc8b8efb34b6114fee78229da4bed071d066285d4c94e07db33a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356311, "uuid": "3915d663-646c-4079-9906-fd206cbb6bfd", "value": "T18508EF0663E116AAD577D2388AAB6503EB73B4071330C7EB329C43652F63AE45D7E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356311, "uuid": "21bfcf34-665f-4c23-b506-6bfea55c2d97", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356311, "uuid": "3e52cb11-7286-4fd2-960c-420fe4db9a75", "value": "1572864:6rA1wejHtS3URV+AK1CsP0rHO2NkpEwbw7:qjiHtFVEn0rz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356311, "uuid": "8d1e2351-082e-42b3-b435-c7e845b758e4", "value": 81322220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356311, "uuid": "bf639176-b50a-4725-b800-87f685550962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356311, "uuid": "e60d75a6-af25-442d-98b5-67fdc957ebff", "value": "85f9f98d4558996f9e45e945ba6347d6beea0745c66c223da39bcf1d46b3c42a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452c4589-1550-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356992, "uuid": "3966f336-5556-4935-869f-29aa6cfb2ce5", "comment": "Malware payload", "value": "89f9b71c482fcc572e6a239a78563d84", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356992, "uuid": "9aeb1987-748e-4c5d-a50f-b368afd84e96", "comment": "Malware payload", "value": "860546e53fcdbe964d48a3a24a0eaa79ceac5c58d1a549c89a1b67c0659454dd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356992, "uuid": "6fac7a69-6f25-41b3-a19d-f398f9af3351", "comment": "Malware payload", "value": "25fed38b99038191536a4b83c4e78905814186fc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356992, "uuid": "b146daac-6da5-4df0-b8b2-4344d7cd4e1f", "comment": "Malware payload", "value": "56f4041223cb669175f14df8a966917480326882002e2ed4f0345b5fe09f64dd73948e9404f775d73873bf6b97449e89", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356992, "uuid": "46c3655c-f6ec-43ed-ae92-6fa506cabc33", "value": "T1A62111270784A2BF5B24C05D8B2C9F10EA02B0E6F44456DF3734DB5B0A840F7C2F5886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356992, "uuid": "f26a11a5-0abf-4090-978e-614ab6b5e9e9", "value": "24:LI2rUbD4euW3mCMDZ8En1Yw5ACLAC4UJsk+d5HuVMXz+u5WNzj5WwCa5WN412:CD4rRPVn1jyBKQdxuDuK/fCaK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356992, "uuid": "1b1d5b66-95a5-466e-891b-7be6824b3c86", "value": 1367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356992, "uuid": "a2e2a1d3-226a-4152-bdd7-feeb805310e4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356992, "uuid": "1aeae43d-1328-46f0-806f-145251a6b7b2", "value": "qfopbwu.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01e3b37-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772385572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385572, "uuid": "0e0923a8-147d-4160-8cf1-ebe5efe08cbb", "comment": "Malware payload (SalatStealer)", "value": "16079319ef23e1d616e8f696f88e3506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385572, "uuid": "d422dad0-167e-464e-bb5e-6eb9e0475cfc", "comment": "Malware payload (SalatStealer)", "value": "8643e2b7ddda69d93eff7748bfbe3c122f67985c24f9723e742cb8415bb0a8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385572, "uuid": "7e67eb24-cda9-40cc-87a6-c072430a883d", "comment": "Malware payload (SalatStealer)", "value": "55a37b8ca746f4a8a2e0f8fef2414e1d79f4dff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385572, "uuid": "32bffc46-36e7-4ca1-84ec-0fb3fe319522", "comment": "Malware payload (SalatStealer)", "value": "2d7f24c1574c4cabb9c16f26af7a156c9c3636446bd7541e2dfa09d6f5941bc9dd1ad34ceb10f40b9bcb4f2fe308a73e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385572, "uuid": "7ca9575d-ee04-4966-b487-0fc5539ffcc0", "value": "T1A7C65B51FA8B54F5E9031831416BB23F23315E048B68DBEBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385572, "uuid": "de6b146c-76c0-4565-b165-ee839f3c9cdc", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385572, "uuid": "5fa350fb-9017-4b0d-a360-9da8a1702a6d", "value": "49152:MtxktkFkPWLDl01NLE1UcQpYjS6x167Du0jKKDDcv0YJNo+CeOr0HPQoqJdW9wPG:UCtkFllZflv0R+C3eqvihpmVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385572, "uuid": "41886cfc-b1f8-489a-8c39-27852f0b10f1", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385572, "uuid": "e6339aee-60e7-4c75-9196-95c2dad7e0f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385572, "uuid": "11b16ced-dbd5-49e4-9746-15a76176d819", "value": "ProxyCloud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9ff354-1564-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772365677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365677, "uuid": "af2b2c8d-d5c8-4a7f-aabb-8644acbe1f3f", "comment": "Malware payload (AsyncRAT)", "value": "bccd380228cc0709c50b6be1b06411c2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365677, "uuid": "c2daeb6e-349b-4efa-be6e-adcd4d041103", "comment": "Malware payload (AsyncRAT)", "value": "86e642bd08f372c81982c022ff3f8e70f535f2b56fc438eb196983d4995bab2c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365677, "uuid": "cf93fc11-05e1-4c5d-9034-cdf57a43030a", "comment": "Malware payload (AsyncRAT)", "value": "0fe8c6ffaed90ba4ad3f17e8375dc62ba32f91c9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365677, "uuid": "9738a9b8-b2a5-458e-930e-4c727c53f0f7", "comment": "Malware payload (AsyncRAT)", "value": "0cacf87492658282fdf9139cf55e8edaf350c2393c7fc40af7239e9c9b810058786388a9f3ef7ae23bfb6797065c2f48", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365677, "uuid": "776c87e7-b9e5-4c9c-b6e2-025d281094f9", "value": "T107F24A0573E58665E1FD1BBD5C3686044372FA478D62D7AE2EC450AE2A237C8CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365677, "uuid": "fd7504e5-62f2-4238-ae5a-a0d999031b54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365677, "uuid": "8fd3d57c-8f0a-4bf3-8626-19b155d55975", "value": "384:YMT5XY+17Ng15KhElE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCvWWWwEQ+:Yi5XHRNg1IhT1hV4RbJwB+WWHLQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772365677, "uuid": "50557b40-a7dc-4282-9560-3e3129ff2aba", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772365677, "uuid": "20f51b8f-133b-4da0-9973-f31fdbbf813d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365677, "uuid": "31e78316-5625-40d1-9e23-e1bf2a060e42", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09af0c7-154b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772355025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355025, "uuid": "a8cd9644-03d2-4718-88d8-e80832db6630", "comment": "Malware payload", "value": "88d2531cd25a4dc46c9d27e5655cdb2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355025, "uuid": "ff7d41da-333f-4e5e-8d1e-03892f22c5f7", "comment": "Malware payload", "value": "89e68c9ef6e040d728ae1d40518d4b16644563299051a49a256adbf6325cb715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355025, "uuid": "159a219b-6195-4db2-8ab2-4059e43ce171", "comment": "Malware payload", "value": "2ee10f28382d66d5cd0cdff3ac0909b36a6b06ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355025, "uuid": "7c393394-9e5f-40b7-a3e8-8b8b68630ca4", "comment": "Malware payload", "value": "4498fc29491d02c823630ec940b9e5034e9e2556f950b5539368c10d74eee40f7b15b56b768163a9d0638a1c78e875cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355025, "uuid": "77fb9cc4-23e6-4cdc-9e54-bb1232189de0", "value": "T16E95E7617C7EB453E9CCB6347721A2ED302E76C5D9E490369EA0CEA985F4B54CE23432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355025, "uuid": "293f09e5-ac57-45e2-986e-160d05eae0f8", "value": "49152:Slds3UPXBQSH14vZh7pIDhG9By8uCGUGan5UPiK/K5F7XlzcKGYH0ye8nanVFflf:Slds3UPXBQSH14vZh7pIDhG9By8uCGUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772355025, "uuid": "06a91938-676a-4751-bdbe-e839e6dea2fd", "value": 1911100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772355025, "uuid": "05568136-c66b-433f-b801-179cb4ec3112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355025, "uuid": "710108e1-e056-4c88-b0e1-798224bbe73a", "value": "kinsing_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b485bbd-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357459, "uuid": "1ec73040-cb33-4967-8451-d2b5ae1b1375", "comment": "Malware payload (AsyncRAT)", "value": "c8b21567df73cbec2ec6c90aa9b97913", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357459, "uuid": "bd90768c-bd51-44c0-b890-b58ab837e584", "comment": "Malware payload (AsyncRAT)", "value": "8a30ba56e557df87e4146c1367a7759b1b5fcf201af78c141b3c756987b30268", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357459, "uuid": "d600f607-0652-436e-87a1-97102cc8376f", "comment": "Malware payload (AsyncRAT)", "value": "afbd14229adb1b847a00d9910c7f293b9fac09a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357459, "uuid": "5a681ccb-58b5-4fbd-a4bf-52055647be5f", "comment": "Malware payload (AsyncRAT)", "value": "d1c87a42250458a8a5e874a4dc608442376e8f86ad7b39f3544dc926e478abcb6241d2ab9ea306015193a9445bb6e261", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357459, "uuid": "140314b7-408c-4b7a-9a24-7705ea73da7f", "value": "T160F24A0573E58665E1FD1BBD5C3686044372EA478D62DBAE2EC450EE2A237C8CF14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357459, "uuid": "2aadc11e-8314-4c56-97e6-be22b1c771da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357459, "uuid": "731fb49f-80d5-40fc-946d-f23e3058211e", "value": "384:jMTh22Q1RzOtaf0hOlE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCTeWW3EQ+:jih2rbzOta8hx1hV4RbJwB+WWP8Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357459, "uuid": "fea1f92a-1e7f-455d-ba2f-ec401acd5b37", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357459, "uuid": "1fa41ad3-c8b5-4ada-8da0-e7b10f4fa7ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357459, "uuid": "e16738dd-40b3-4406-9d69-6d2611c95d78", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aaafb99-1550-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357001, "uuid": "17463799-8256-4b06-9e48-8f90aaec8737", "comment": "Malware payload", "value": "0d28eb747209210bcc86be5baf9ae2e0", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357001, "uuid": "97cebc4e-c8a4-461e-adce-15baaa9f6ade", "comment": "Malware payload", "value": "8b2f8f5ec21f82d5925f77734a6ef8b48156a729ff55e1deb49277985610d34c", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357001, "uuid": "d9e07da7-91ef-403f-a84a-3ac8b487a5a4", "comment": "Malware payload", "value": "d2f41c41b50f5d113a7470bd543773a3f9f532c5", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357001, "uuid": "75506c83-42b6-40ed-8a4f-2aa6e63008da", "comment": "Malware payload", "value": "782b3ba1bcac826b80e02ab2c622604355b17dce1b554f5215c32b0f56b3522cda9c8dc7bf0f4aebb27cc0c9230e8752", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357001, "uuid": "66232fa9-3cdf-4154-9af7-814e0083e5e9", "value": "T1D9E173408C49D1D019725109DA9BC908EE1B73171BF50E6BBBFC80B96F3443DA7A8F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357001, "uuid": "04f0d709-f5da-461f-8b8f-8898cd2acd09", "value": "96:yZcXmVB5NjBIf52ypxX6rZwAu2OherAKsNqQAo4JP2mEK2fEtR9s5z+s:yeo5Nif52ypxX+cTJE2LzfEtUqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357001, "uuid": "ae79a3d3-c07e-4618-9908-c54064049f4e", "value": 6779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357001, "uuid": "f00cb890-844d-4d25-ab0a-862cc000ccd5", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357001, "uuid": "f7932159-d6c3-4749-a886-6016018b9f7c", "value": "sb.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d11b1b-15a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772394784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394784, "uuid": "ff560c27-5576-42cc-abcf-a7eaada1b431", "comment": "Malware payload (Mirai)", "value": "2f92e25048e17a3b1e75b147292944d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394784, "uuid": "371a6c58-7c92-495a-86ab-36cb91fcc9cc", "comment": "Malware payload (Mirai)", "value": "8c5a36feec49be5e59fef28254178346cbb90ec341b7f43768929ae707a7a78b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394784, "uuid": "fd28d24d-45bc-4160-bdce-590dfc60273c", "comment": "Malware payload (Mirai)", "value": "8b5091f35bbc039385eaa7352998d93f2491d6d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394784, "uuid": "9f70f425-cced-4e64-99d4-14454a10cba8", "comment": "Malware payload (Mirai)", "value": "1858ea142a6ef9a065cb307a89c997da3c780b68bc87ad26a66d769e78f0015fd01e2216c27d71b68c6f4aa761d1af80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394784, "uuid": "b8c2dbf5-89ab-496a-8d55-2dddb077fbc6", "value": "T172E30A45FC919F26C6D2257BFB4E438D7B2A1768D3EE720399255F20378A85B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394784, "uuid": "366cb57b-c30f-4842-a9db-1c5fbd740ef1", "value": "1536:Gc4EfqA2OxC5Bpw135xWh+IDHIKONImPFhJ1ADp00TWhJi7fUOzJyHsTkOaltRwC:rfzhxAVSNb91Aq0GJK5YsoIIgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772394784, "uuid": "2735a73d-6440-4351-a12e-d42c24619220", "value": 154336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772394784, "uuid": "cb465665-9c86-4050-9d62-d6810d8a7b78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394784, "uuid": "8ca410b6-47d3-4d55-8d3f-3e283c438a86", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0153b749-1577-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772373629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373629, "uuid": "83d7ac1d-439a-4f06-bce0-45cd8ab1b726", "comment": "Malware payload (AmateraStealer)", "value": "d02e99875c25a7551ee90992161bd706", "object_relation": "md5", "Tag": [ { "name": "94-26-106-194", "colour": "#BEA453", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373629, "uuid": "69c13555-cf98-432f-afc2-3255b0e6541e", "comment": "Malware payload (AmateraStealer)", "value": "8f1146df7b1350500da786a8673fae61b77b4caccdd484200d0d351fc7817a32", "object_relation": "sha256", "Tag": [ { "name": "94-26-106-194", "colour": "#BEA453", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373629, "uuid": "7cbab3b0-7f38-4537-a2be-085a50fe45f2", "comment": "Malware payload (AmateraStealer)", "value": "1bbf12812d420109d15fcec8ade6e4b4f984652d", "object_relation": "sha1", "Tag": [ { "name": "94-26-106-194", "colour": "#BEA453", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373629, "uuid": "bdfa47de-32a4-4af3-8093-9e4cb2940a7a", "comment": "Malware payload (AmateraStealer)", "value": "2cd7208e0de930a89092c25be00512cedcc6188098c96d6a241c7df2886a175ebbd07f497f880304f25c8a3edbb06fa1", "object_relation": "sha3-384", "Tag": [ { "name": "94-26-106-194", "colour": "#BEA453", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373629, "uuid": "552e0ab7-0a3c-402d-9d7c-51a26908b616", "value": "T15124C0329F07BD9381C067F3C967F945EE2841DE13A769DC36AEA141304EDA86788D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373629, "uuid": "94614836-43f3-49dd-beb0-95fc918186db", "value": "6144:ftfyjXtjNO3EPTCCdnVflXU6HHxV1lFYEGRNsv+sHWSzu7:gpjcCdVf5U6HHxV1HYEeNsvx2+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772373629, "uuid": "95c5c14a-672c-41ba-a9b0-70a093634c1a", "value": 228610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772373629, "uuid": "765462e5-ec80-492f-a694-99e312fb9d0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373629, "uuid": "5d49f510-c80d-4c76-b345-15a6ec14a306", "value": "pipe.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ff16fc-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772385605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385605, "uuid": "539a711d-ec92-48f9-8057-bc29230303c9", "comment": "Malware payload (AsyncRAT)", "value": "1734941c7db71d26bc131dea28a8a183", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385605, "uuid": "5e857609-2e13-4df6-ae12-62393f7364da", "comment": "Malware payload (AsyncRAT)", "value": "906b48a6e50edeb27678fc47e419fe8be24dce6b3c73edaa28acd96fd488189b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385605, "uuid": "c064e691-e010-4a7c-85d3-18e6b686020b", "comment": "Malware payload (AsyncRAT)", "value": "84119b71a303d297679f0e618e7012e6086c8159", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385605, "uuid": "a48a607f-ec48-42d8-b1af-ac83f8b53b16", "comment": "Malware payload (AsyncRAT)", "value": "a7de677416c463b237605b3a482a83090d376721208bdcf48cc845e0f971399203bfff6517275d380ae32516e7175238", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385605, "uuid": "0dbce17f-f9f4-4641-9c58-96b037120d36", "value": "T1FE53E8003BE9C525F2BE9F745EF6A55006B9F5A76A06D50E0CC441CA0A32BC69D42BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385605, "uuid": "94d254af-9308-4ca0-b7a5-2205a6aa477c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385605, "uuid": "cdc80c85-e4bc-4b68-8eaa-0e8e713ebf0f", "value": "1536:ajT7Kqibw7q5xBibU5plvnLEQZv493WIx:ajT7Kqibwm5xBibU9vnLF03Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385605, "uuid": "608f3131-115b-4373-a8b7-9683959b448e", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385605, "uuid": "58346733-1a00-4cf8-ad78-449f6763d011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385605, "uuid": "0d7cdeda-236b-434f-a0c9-b206539f3f61", "value": "1734941C7DB71D26BC131DEA28A8A183.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ab3d52-1510-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772329593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329593, "uuid": "16b08a62-b7ba-4b38-a58f-d482a3c4116f", "comment": "Malware payload (Mirai)", "value": "2ffea6f488f67add976e8c4a7a3408d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329593, "uuid": "6ee29b29-624d-454c-8b7e-d6402642d9ab", "comment": "Malware payload (Mirai)", "value": "90bbbd6ebf0f4dd9e2f5fea0d2b27d5b856fb65bc1765a4bae1fd95c6a06733f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329593, "uuid": "3158878d-6366-48a8-8bae-d15b3fd9a8e7", "comment": "Malware payload (Mirai)", "value": "db39930f67f408f341d5faee4086eabf4e5b8290", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329593, "uuid": "2f06d817-f547-4044-be09-a6bf296b14a2", "comment": "Malware payload (Mirai)", "value": "c9577fdf49fad59422416b17afa92548c0914359567498bcb10f23a025297e631cccb07f547f21cab944c19252c7f4e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329593, "uuid": "e3cf03dc-8908-40d7-a690-8e27619c3a1e", "value": "T19F343B45EA418A13C4D117BAF5AF418A3332A795D3DF730699286FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329593, "uuid": "72396a8a-5b01-4809-8db9-17c23ca434fa", "value": "6144:YIoX0lMTL8+yabqqcVRF9YnJVDuRf9ihM/95AU:Y74kg+yabqqcVv+JoSG/DJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772329593, "uuid": "0414390d-8f99-4fc5-9ee2-4b31fdd83588", "value": 230952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772329593, "uuid": "9ed16d9a-d818-4ae1-bb38-edaa209b03c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329593, "uuid": "cee72a0a-b87e-4002-b38e-7b204696d12a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb156c5-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396819, "uuid": "8d7f3f9f-f378-4b60-9573-3ec8113dcbef", "comment": "Malware payload (Mirai)", "value": "2941f38faa562e762169a652475b0f39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396819, "uuid": "c60d7896-4f3b-4298-bc22-65ad85991868", "comment": "Malware payload (Mirai)", "value": "953dbd67e4f1e582dcedf8e9e7d8abcfb74572e338e79a8f0cb524156f29108a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396819, "uuid": "b3f708be-028a-4ed6-a9b3-9372484b73ba", "comment": "Malware payload (Mirai)", "value": "bde9cb5cfa6d30251969c932bee85e9693fcb435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396819, "uuid": "86e27df5-5d1a-4cdb-b026-11cc068c8e06", "comment": "Malware payload (Mirai)", "value": "b7d0c1059c777c7e2273c8331c7058b62c33ee70d0a246a6e4be2fb4fb76a4346333702aa92f77bd2ca4c0ab01f35dde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396819, "uuid": "816edc71-ee5c-4c4a-b747-af2f55bc15f5", "value": "T1AD241946BA418F13C0C627B9BA9F42453323A754D7E77306B528ABBC3F8779E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396819, "uuid": "2d38b2e4-aae9-4f0a-a338-85a129f7dbeb", "value": "6144:tG1cjvyvu8aYWsNWYAcykiAnyDXBiUM/Rf5rcd:Guym8atsNWYA1Vtdip//Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396819, "uuid": "4016af70-4f40-4ac5-9a81-91d525f4f7ca", "value": 214617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396819, "uuid": "e661fbdb-9716-4506-b27b-67d28f4a10d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396819, "uuid": "78774c65-bf5a-4f4f-9b8b-f3d28a26afcb", "value": "csk_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17cd4c97-1570-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772370660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370660, "uuid": "1a3e888b-0f00-429b-85ef-76a4c0847f07", "comment": "Malware payload (Amadey)", "value": "f4357eeb4d9ac8ab0d819e39533bbf5b", "object_relation": "md5", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "91-98-149-203", "colour": "#DFAD4A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cyrex-cc", "colour": "#CB1226", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370660, "uuid": "d56b31ce-6770-4fb5-afd8-e0a4cb57637e", "comment": "Malware payload (Amadey)", "value": "95d82bc209a1a52aa950e04b1ba5e256e90c6e3a8202d141a76f35089b8265c1", "object_relation": "sha256", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "91-98-149-203", "colour": "#DFAD4A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cyrex-cc", "colour": "#CB1226", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370660, "uuid": "4663c522-0466-486b-a230-1c52e4da8de8", "comment": "Malware payload (Amadey)", "value": "23002547d348255e7c1ddeb8bfe0147c0ed31253", "object_relation": "sha1", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "91-98-149-203", "colour": "#DFAD4A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cyrex-cc", "colour": "#CB1226", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370660, "uuid": "ccd639f9-5d2b-4bc5-8189-2a0e7a55da80", "comment": "Malware payload (Amadey)", "value": "61719bed981b79bee0578642a3b8edfb93c73bf1444b9587d278af6c4e7ec700319372481027a21b8accf24ebb030202", "object_relation": "sha3-384", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "91-98-149-203", "colour": "#DFAD4A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cyrex-cc", "colour": "#CB1226", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "pw-cyrex", "colour": "#72B5C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370660, "uuid": "7c6791a3-f443-4b2a-a069-315fe977238e", "value": "T1570833CA99059F61C09EE67726C934485BC1D110926A8B3DA1F3F6D40BE6BF69083F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370660, "uuid": "a5e6f792-3572-4c65-871b-bda3b96d062b", "value": "1572864:REHRvTH7PvRKdt95TSPZ2GK5FZNGkfwUK+ziGchujqgnlWTbL:RcbbPYH95TkY1vfwK+ZhueglWTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370660, "uuid": "526dc9af-03ff-4917-ba44-d6bf6287a9a4", "value": 84677295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370660, "uuid": "4e602768-6b9e-452a-8e98-bc2d9335022c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370660, "uuid": "4ba18442-6fc1-42f0-b56a-d2813f470e00", "value": "Cyrex.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190ce4da-1569-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1772367656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367656, "uuid": "be309c75-e493-4d77-bdc2-568600d681be", "comment": "Malware payload (ACRStealer)", "value": "229ad6f4c8ce394ef2bf6c7dbcd03974", "object_relation": "md5", "Tag": [ { "name": "144-124-246-132", "colour": "#5E0BD3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367656, "uuid": "efc2f409-9660-499b-a28c-b610118c2951", "comment": "Malware payload (ACRStealer)", "value": "994352fe35f11daacb521e81af0e7b1ac7e10af7e74797b8be4660e68c6378b6", "object_relation": "sha256", "Tag": [ { "name": "144-124-246-132", "colour": "#5E0BD3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367656, "uuid": "8a8ec6cf-7e9b-47e5-97ec-542579191df2", "comment": "Malware payload (ACRStealer)", "value": "41d45bf677c1485e3fdc47f235e97f7466551a5f", "object_relation": "sha1", "Tag": [ { "name": "144-124-246-132", "colour": "#5E0BD3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367656, "uuid": "78a0f59e-57fe-41ec-8d9c-2e9344e4c2e1", "comment": "Malware payload (ACRStealer)", "value": "0df088fa3b9e84d673d0acd8330d5543baf5d1a3c0d0032c72bd426def0f351a5abf5fe1758ba52b51f95eac80038044", "object_relation": "sha3-384", "Tag": [ { "name": "144-124-246-132", "colour": "#5E0BD3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367656, "uuid": "31116eb4-704e-49b0-8c12-0df2eb6018e3", "value": "T152A59D22E2ACBA5BC06E09F99F521179D97B2F110253D8377563B7A68F3316CCB9121C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367656, "uuid": "cbb98347-be26-46cb-820c-b63f5f38caf8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367656, "uuid": "3b63e9de-39e4-494a-952b-99743a3dcb1e", "value": "24576:nW77QQM66308L2Htxu4fSsF0PeKK31u4L2BrszcWiRywPJvTNs1/7Ze5r56/RgR2:67QIS08VcSbCwpWwZPJvo6rIxXTmuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367656, "uuid": "2623e16f-4223-4df9-814b-f5415cd4d958", "value": 2108416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367656, "uuid": "3c59b480-62e8-47fd-b50a-693565a81b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367656, "uuid": "013e043f-be8e-4ac4-b1b7-1221c0c0b11e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ee177d-1548-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772353549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772353549, "uuid": "7597e43e-0918-4554-bdd0-9ca9b50ce9c5", "comment": "Malware payload", "value": "790b2105af1e7eca2f3e0c7cc04f5ef1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772353549, "uuid": "61c4e3c9-79b4-4877-9120-a7d61d5b445f", "comment": "Malware payload", "value": "9998950401be061d45be70be00b5b37823cc2c194d4d464f7eec5d8ed475b3d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772353549, "uuid": "384dd0e6-9238-43a2-8e8e-116de20d18f3", "comment": "Malware payload", "value": "c2c7bf0fbe2bf6dd2999e7f07f526e0c4e65b28b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772353549, "uuid": "0d0f8d57-62b9-4e13-8b38-c65bd5a14e5b", "comment": "Malware payload", "value": "241b795047b03cf9f6b0708cf522dc0b53c4d97765e3b33d7123a899a606e124ec56903c568a8c29ab42175e6da78c70", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772353549, "uuid": "ad31552a-9994-45a9-9172-22772444d176", "value": "T1BBF0DD02A1506E655B31CC0ED7C07B4A433403F1B58C7A2A89F545C21FBD483365EAE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772353549, "uuid": "c861cbd2-f718-410b-b437-86f8d9471bff", "value": "12:8q0HsOt1Vvhs/LqoQ85nXPdwybzuwfqRdL7kYV0VyVIVs6X:8RHsOt1xhUOu5nX2bwOB7JmYCS6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772353549, "uuid": "1eb08e20-5672-4859-9e9e-c6aeba3e69bc", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772353549, "uuid": "f7cbb945-f225-4806-b075-06ca5c5b2cb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772353549, "uuid": "b05db7c0-908a-4d31-a9e6-de27f7d08e86", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b56e2a-15a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772391586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772391586, "uuid": "07a898f5-a299-46f9-98d1-876c2ef43e92", "comment": "Malware payload", "value": "894c96fbc0de466a6e6e955722cc864d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772391586, "uuid": "1bb7b8a9-41fd-4b1e-922b-a78993c0adbd", "comment": "Malware payload", "value": "99a995bbf09df2094c2aabf95d9a58553bbee1ff7abc97d1490c46baec876c62", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772391586, "uuid": "3e3eec1c-2207-4552-83fd-aa55a63aea17", "comment": "Malware payload", "value": "8e402ace7d384722e0b0fe58f702ac51d32e1e02", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772391586, "uuid": "e365b02a-8a4b-4d87-9dc2-811305195bf6", "comment": "Malware payload", "value": "44f021ac46dd00a4e1323ccf0732d572f0c554d6faf0297d3ad5259cb56b286e09722508c81d99e7ddf6b971a20a7553", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772391586, "uuid": "4fc81402-8a13-4db1-9d69-c39d8519beab", "value": "T1ADC5331EB9F2C7FEDDA3473E08890A56763C2EF889C8764B55969BB873C114291473C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772391586, "uuid": "764e79c7-2c29-48b6-a735-4200072ad4f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772391586, "uuid": "4e23c58a-9aae-4ce9-97e7-465c705ff47d", "value": "49152:XBiqFoNj5EK2kz8bcP753aWuT9pM4wUuKNES9bYPzBgbTAy/FzRzYu/e:RQEJCPVTuT9Um86bcy/FzNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772391586, "uuid": "f83832d7-cf6f-4fcf-aef6-3566d71dac42", "value": 2626048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772391586, "uuid": "b238b9ba-1160-4d83-a167-87155d6eca7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772391586, "uuid": "adda5072-06f8-48e5-9034-1fc79b1ae904", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5235b5-154e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356066, "uuid": "9afa2ddb-3046-4cca-bf8e-dd3c85b80598", "comment": "Malware payload", "value": "d734c58b82ee422642b839180ca0a741", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356066, "uuid": "ccf56ffc-1f58-47d6-8999-2cff325b3065", "comment": "Malware payload", "value": "9aaf4a4d7091004dc347bcfa0b2bc1e5630be307633316f2100b6f0e3e2f32e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356066, "uuid": "ca25dba4-7608-4046-82ea-b2d80cba9219", "comment": "Malware payload", "value": "39a9341fc1844001307e6260bfe5b85df0080715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356066, "uuid": "68cbff64-f1a4-430e-97e3-b8e2c4d0e6e8", "comment": "Malware payload", "value": "ac95af360c35ee2fd4c870858c3af5b986f8035697c91e9995fdb63f862f33eaf388bf81e38e7f8b8e0ab0fdebf12ffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356066, "uuid": "3cbe80ec-317d-44ce-a34d-a28e867d246c", "value": "T18C08E00663E116AAD577D2388AAB6503EB73B4071330C7EB329C43652F63AE45D7E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356066, "uuid": "075fec30-aff4-4872-be33-6d634ad79531", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356066, "uuid": "f2230a0d-c89f-4706-8f77-ad9b691694fa", "value": "786432:6B5zM31we2iBrxDvIEMwHVCgPiOvBURVpiWV1CVuEwoz3fa7s9BRWYF3eKyaPpvr:6rA1wejHtJBURVpiK1CHPOstO61D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356066, "uuid": "863903f3-45e0-4443-b499-ea7ed497076c", "value": 81324354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356066, "uuid": "7d86b31b-468a-4393-a5bc-33c83d92f3f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356066, "uuid": "de80f555-7475-4230-9a59-cd6907a07a7e", "value": "9aaf4a4d7091004dc347bcfa0b2bc1e5630be307633316f2100b6f0e3e2f32e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f827d2-154f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356512, "uuid": "2e23e225-749c-4385-9be1-e0e8b06db241", "comment": "Malware payload", "value": "aa2a449558f637c46d088678c3d701a3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356512, "uuid": "3a0d4f8f-7e0b-46f3-ae15-8677015cef65", "comment": "Malware payload", "value": "9ae895cd6474d1928bbbd68e240679c9de3c0ca327ac4e4b83845878b72322be", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356512, "uuid": "0944d89a-686c-4739-a9bb-a11b744bde29", "comment": "Malware payload", "value": "07c9876472702acf698bb16f832ec4822e14cda8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356512, "uuid": "61570e3f-0607-4d8a-b7f4-52994c5d84ed", "comment": "Malware payload", "value": "c9443bb72e689a2a7c194b4e579a7ac381cef904c4ffa1f9575283fb7dfe3ba03960459a7bfe260950aebd02b9122918", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356512, "uuid": "7dc9c605-fc37-4419-982b-bbced276fb03", "value": "T1909633C2F316192EC8B300314E96473517099E56CA8AA74B69BD37BCBC7B7894E59FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356512, "uuid": "51259aa4-29ad-409e-9b71-101d127ecd74", "value": "196608:a5Qf+J0S4ajC4LzS/BVxlUFE5+ZnXE4pXbspBbFTVt+dmWlpgoLyStn1Y:TfK0ojCES/7kF9ZnXp4bFpkRlpgoLyS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356512, "uuid": "8b24c496-53bf-410d-a8c7-af6a1ce002de", "value": 9455774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356512, "uuid": "44d4887a-2281-469e-8382-fe708a3a8bcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356512, "uuid": "bce14f02-71ec-4a06-9938-a4deaecac0cf", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4879c6-1577-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1772373729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373729, "uuid": "0e3f159c-51cd-4ef8-81ff-1d0c46dc5eca", "comment": "Malware payload (HijackLoader)", "value": "188b1df9bc3e1dbef887112029f0acb4", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "c-waltherwolf-com", "colour": "#982DC0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373729, "uuid": "0a5dcbaf-562e-4f94-a532-5780594abb7e", "comment": "Malware payload (HijackLoader)", "value": "9ce9cc80d2795f1d40fcdedeffae79c69bbed62eb89ff3587d5a6a482f112e7d", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "c-waltherwolf-com", "colour": "#982DC0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373729, "uuid": "70aca790-449e-4712-9d9b-c2f9ca65a789", "comment": "Malware payload (HijackLoader)", "value": "6b1e09a7894dfaeb02993a553a205a44fcc4fbfb", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "c-waltherwolf-com", "colour": "#982DC0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373729, "uuid": "df4e108f-5037-4ba7-a0dc-4fedac04af6e", "comment": "Malware payload (HijackLoader)", "value": "475f8e9b4034335862037edf336c9272631c8983014b3aad3f056c6b3713bf3773dc3c604569d96ebbff67a2c61ad8b7", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "c-waltherwolf-com", "colour": "#982DC0", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373729, "uuid": "bcabf3da-e119-4098-ae45-2681e4a14046", "value": "T1930633513AC5CA36E65E2877517AA766213ABE710B38C1CBB6503DAD8C347E2F934313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373729, "uuid": "aa415f81-f81d-4940-8ebf-58b2da808e0c", "value": "98304:Rp1X9K0lzB2hEqg48bWkYKJOBe+aGp5VDOiDeTbfSQx:N00lzB2hZMbWRyOBe+x9oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772373729, "uuid": "ca5ec920-b7c9-4968-8841-cc9cfbccd080", "value": 3825664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772373729, "uuid": "a3f45501-b14e-436e-8df8-4968e36abbe0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373729, "uuid": "9e73bc5d-e549-484f-92c1-f25869f794bc", "value": "LabST64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e428fe81-1565-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772366278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366278, "uuid": "13d1dd85-5a7e-4cb8-9072-94fc77a13eb3", "comment": "Malware payload (SantaStealer)", "value": "fb10edd25f7705583abf1ede447af685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366278, "uuid": "f9f69555-bcc2-447a-a667-18473080d16f", "comment": "Malware payload (SantaStealer)", "value": "9db4df78a3d849e1a2c624980ed5be1fd3808f0b7aa38dcc71c08ff4ade7c533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366278, "uuid": "2f88ee7d-70cb-40af-8b20-2b0aedfaf178", "comment": "Malware payload (SantaStealer)", "value": "2073e632f82664f03841e1c271bf7a6b29b9c8f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366278, "uuid": "979737a5-be73-4b8b-9a15-628be93132d8", "comment": "Malware payload (SantaStealer)", "value": "37ecfe3cd565755db603be027185f38b20baa83a88f17224106f6f382407dcb8041c9127db4cba894b93dde24e9e0f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366278, "uuid": "8694887b-207b-40d9-8550-d9672acb7a6b", "value": "T1AF46BC59B75B3CBEC30B4238856B57357419E685462ACCBF46E2C3B0FC30A45169AEF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366278, "uuid": "55ae02e0-3082-40a2-943e-c383b0840e1f", "value": "07d333ce0be6bfeaa14f1967a4a77e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366278, "uuid": "0e0f1d17-f2da-4155-a2e8-fe7ae036892e", "value": "98304:FaLiX069IF9wD8z/FEfN83S6o/sqIFlzpULGBn5VJuATN8U7sZ2ptnsJAeu:FVOi8zdiEEsqIFlzppB5VdR7sZ2ptnMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366278, "uuid": "ad129168-0a0c-4cd2-a234-1aba7c394b39", "value": 5658624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366278, "uuid": "9dacac29-bcdd-464b-9323-ec7296f30258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366278, "uuid": "3185b007-3979-42a7-9bc7-d62153a952d6", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce87a02-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772385540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385540, "uuid": "131dc744-1da4-46bf-860b-24a29ace0950", "comment": "Malware payload (Formbook)", "value": "c7075e56b54dc4bb578726da127b4f0b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385540, "uuid": "b35f1ff7-f492-443c-984b-33cd297c4098", "comment": "Malware payload (Formbook)", "value": "9e1f9919498809e79281a8ec7db2e24bef7b5b631792bd28c0716eb1a1fed35c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385540, "uuid": "5198778d-9648-4952-8798-d4101fbd0049", "comment": "Malware payload (Formbook)", "value": "c8e561603dcaf8d47c4853f2a58eb35a0aa04312", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385540, "uuid": "7bac0cf9-3f20-4072-93c7-237a8cf042ed", "comment": "Malware payload (Formbook)", "value": "2dd55b83192f6f733dbff6118e8ae662e5621ca2c547bf56d35061985145d722a1ab95b19ba61822a7812c62bd6aae1e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385540, "uuid": "dcbfd709-8bfb-4098-901f-6fcc3c82435c", "value": "T18345D1B2CDAD4F498EA04B2C82C7156CF2F056016A597CA3BFA5BC375FB109E5027678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385540, "uuid": "5645675f-91ce-4d1f-91f2-d63fd650f1c2", "value": "24576:2Qq94fYKPZSedMPL0CCgz01mH3M+Bit1T+z4HORJj5m:2QGVYSICC/IUu1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385540, "uuid": "51ae7a4c-161e-4cfd-a0e6-b53fcdaf0a49", "value": 1278003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385540, "uuid": "f60afe42-f1b2-4a56-b3f9-55bcbc8a35e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385540, "uuid": "ce7313ce-c66a-4294-a150-7cf7f0aad196", "value": "PO-TG048432026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14652fae-1552-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357769, "uuid": "b5896c1b-9911-414c-949c-9b50bdb5aee2", "comment": "Malware payload (AsyncRAT)", "value": "63a4faa401e15e9f6d34587996740a99", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357769, "uuid": "6a2030fa-a7d3-431e-a9dd-3cf380ac71d8", "comment": "Malware payload (AsyncRAT)", "value": "9f2363bef0d47ba48b95ce505478613497d4663498776434c5decabcb1fe1dd1", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357769, "uuid": "06967521-226c-47b1-9e36-ad8c03bc19e8", "comment": "Malware payload (AsyncRAT)", "value": "b4f5c0e3a6143207a0cac20b23d72dfeafd847d4", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357769, "uuid": "0898677f-6571-426b-a980-f69a348a2094", "comment": "Malware payload (AsyncRAT)", "value": "f649d03b6eca45fdcd56e950577fd60dac423bbd74f7965be2788c9b256ef6cd58a377496e5673b49a15847c35942995", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357769, "uuid": "954d02ce-501f-4f33-b900-3d60c5928e5d", "value": "T19116AD14A3E500A4D97BDA34CA699332D6BCBD524735910F258CF2D61F33AA18F2F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357769, "uuid": "5a79a889-412b-4bfd-a7f0-740bb36169ab", "value": "bdf15d3de7b8a37cbe5bd9c47cd37b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357769, "uuid": "e28657a0-370c-472d-8c51-db7d5a2f1b71", "value": "49152:maGRQsdpBS7I2IjbfRG4MsNZz6oU0HgYR1C78Q8YqJecGQIyyRM1JJNsLgu/E:AZjF1hHgYCU6yysLni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357769, "uuid": "db6dfe3e-9ee8-4069-8e2e-f5fd9f11c7a3", "value": 4377088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357769, "uuid": "e926e363-27d2-41d2-991a-c36bf351efc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357769, "uuid": "d8d5105e-5ba8-4b08-843a-8aaeb80872f9", "value": "WINMM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c1a15c-1565-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1772366308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366308, "uuid": "81bffe75-1f06-4d52-bf86-b57c309fb9e3", "comment": "Malware payload (EternalRocks)", "value": "caa3ff32ed8fecd3b15efc1fbb54040d", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366308, "uuid": "d96c16ca-547f-4f0e-b8f5-fbf7273675e2", "comment": "Malware payload (EternalRocks)", "value": "9f3c3388c6ce825295a8c36a7668a215b4f0defdd2335e9fc29810d4a5a0b1cd", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366308, "uuid": "edd7e444-a596-47ab-aa3a-80c0c423cc77", "comment": "Malware payload (EternalRocks)", "value": "14ada28a81370b2131e820e42b8a56eed5e3ec37", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366308, "uuid": "65928571-f687-46d8-88a2-0b3d70efc433", "comment": "Malware payload (EternalRocks)", "value": "58f314861289dd3407174391aa041b02ade52b845ed03310dfedb04813e4e2e05c2a02c7430caed91d2d80ab805b6463", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366308, "uuid": "88f174d7-10f1-469e-bb13-5a6de4966f64", "value": "T1C855F5A84E1B38C8986568D6C252B1425FB5063F6D3DC8437B613E01A62F71EDBCDA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366308, "uuid": "7246bb3e-016e-49df-a740-d3246b3b904e", "value": "12288:VjzOpl7pz/2u6P/k2AUPRB/GrkhH5pbkkqm7YuQbbqkEu4+oytJvw/O/q2X8T0Cg:JOpdNa3L4IGC7eqkvC5+tsKY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366308, "uuid": "59a25c2d-5f97-4baf-b6a6-d1e4548eca5f", "value": 1300903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366308, "uuid": "7dcfeb9f-a7a0-4a45-bce1-969a1225608a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366308, "uuid": "3b79bdda-2319-4d73-bb91-364442b03be0", "value": "n2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d48355-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772385521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385521, "uuid": "4cc9a495-f1ec-4eff-8a53-ca79dc890a72", "comment": "Malware payload (Formbook)", "value": "d93c7c2a71bde53cbec6e7c6f2bc8ab0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385521, "uuid": "82ccca27-8fee-4ce0-9d25-fb94610a529a", "comment": "Malware payload (Formbook)", "value": "a1da3b0fc4386d3a5dab8dc264b2475e0218fdce04e5f28f90b834881211ceba", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385521, "uuid": "1c6ec841-056b-46fe-8db3-56ef8aa60dd7", "comment": "Malware payload (Formbook)", "value": "7bd52731ef618e945f6fa128eada844d9aeeeb21", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385521, "uuid": "d397c8d6-a3bb-4a75-8a79-5b7d49e8d1a1", "comment": "Malware payload (Formbook)", "value": "906e0ab0451fa1f995cce5cd90cbf73ff49bb37905de8f625939b6a0ea5e38e66e64a6ad9f4f03b178131b59e1f038eb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385521, "uuid": "c276dab8-6d67-486f-ad39-d2a6f4018a35", "value": "T1BFD43326C5B254434CEB1ABAC8C22DD4A702BD4B96204FE0B76576F4FBBE30C42935B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385521, "uuid": "e15d8592-36d3-4e01-b824-38ed974344ed", "value": "12288:dDIW+c2FC/n1gsIWsqPbJC+kQJ7yQHjfXIihNv4E1S45:1IW+c+CTIrkC+pGmjfXIiPv4945", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385521, "uuid": "4576bcd0-4579-479c-899e-5188b37ccaf0", "value": 627724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385521, "uuid": "09e1b3ac-6951-4cf5-ab82-2d3b392ceaae", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385521, "uuid": "445e4d81-346b-401b-a274-26ae188872fc", "value": "01032026_1636_PO-TG048432026.js.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ba350d-15ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396960, "uuid": "3a0ba295-70b7-4fb8-aee8-178eecdb56ec", "comment": "Malware payload (Mirai)", "value": "704ea90e98e7602a42e2a4ce829a186d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396960, "uuid": "f717bf92-5790-4990-9b4d-112492da29f8", "comment": "Malware payload (Mirai)", "value": "a211bccb67f78624e7db09fa083e51b17df50e76fa7492f9ced0f0cb3ee6ea36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396960, "uuid": "8bb2a323-81fd-4c4b-935e-1895bce2e587", "comment": "Malware payload (Mirai)", "value": "8d120b0ac003f13dabe63c2cb4855dff8fc7cbd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396960, "uuid": "09004791-2f13-4fde-bdc9-b150934d64d6", "comment": "Malware payload (Mirai)", "value": "5c1881eb50590c73ca3bddc08ef4f1e1a0baa3bfc119d04aa74202eedae4883b9f21a3738dcbd751cc5f70cfda121441", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396960, "uuid": "4d05cd59-2f28-43ad-bceb-3befd881443c", "value": "T186144D137B324FA0D325D5720BB38B5A59EB11C21EE258D5936CCA103E20BAA585FFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396960, "uuid": "bc892571-6bbf-403f-aa6c-c76e52fc9ab1", "value": "3072:cYp2gqHLKBCJVPhQcsoyPqEYSEpwwYswRw/N4VLsUpF:l2giLjPhQdoC8dwLm/Yse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396960, "uuid": "9a6b954f-9adb-4b94-ad38-f57220457f1a", "value": 201128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396960, "uuid": "82aac982-6de1-4f7e-afb8-3b150a5d4a91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396960, "uuid": "221ff77c-53f9-4f3d-9a3b-0298c3e0ecb2", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ddaa97-156d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772369477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369477, "uuid": "e3fd020e-6f1f-4a4f-9856-cc7c37e271da", "comment": "Malware payload (AsyncRAT)", "value": "738020b211d9c2d0d0f139443e42c403", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369477, "uuid": "20fc5777-8e2b-49e4-a394-7840d67f0f12", "comment": "Malware payload (AsyncRAT)", "value": "a31b359be8ae138143378cd2ce238f3a430242bf365a6c325491c3e898584f50", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369477, "uuid": "7548bd7f-ccf9-46ab-a7ed-ede270e2f821", "comment": "Malware payload (AsyncRAT)", "value": "eecbf9eb3f0aa2cf4757e18cc173d7584280ce8e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369477, "uuid": "e326fcae-02f2-4e34-8ab0-ea22d9a4baca", "comment": "Malware payload (AsyncRAT)", "value": "70b41a855ea0090ca666de7979832a07f1243a5aba67ed5f28c1ce7ca0db989b68f98a247fa51e2335478a5f0d89cc9c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369477, "uuid": "1c5307f7-42c8-470c-aee3-72864d802250", "value": "T140F24A0573E59665E1FD4BBD5C3686044372EA478D62DBAE2EC450AE2A237C8CF14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369477, "uuid": "67a7d300-4eb4-4a9e-926c-6363d2a4bc2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369477, "uuid": "6b1db445-5592-4602-a2c4-347a3b0d5a5e", "value": "384:gMTh22Q1RzOtaf0hOlE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCuhWW3EQ+:gih2rbzOta8hx1hV4RbJwB+WWNcQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369477, "uuid": "36910cd8-57f8-4723-9c72-4b4bb53229b1", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369477, "uuid": "e657606b-6690-4803-8fdc-a0a1d9ba5009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369477, "uuid": "ac79a967-7de7-4dea-8994-38d3f6ce1b83", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4d877d-1561-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772364228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364228, "uuid": "a7704b49-e45a-46d3-a930-24f278674580", "comment": "Malware payload", "value": "d8dc4591476fb53cfd842a493bb6753c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364228, "uuid": "80b19bf0-758c-4f26-87fe-50bc4017b281", "comment": "Malware payload", "value": "a31e83824b1da9be127cfef373d59cf61b6a07eeb8b6a982d15864127372254c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364228, "uuid": "f496c786-e9ab-4460-936d-3be7a34c67a1", "comment": "Malware payload", "value": "786b109c8b6d7b0da5388072540e2560324204e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772364228, "uuid": "afa65d8f-61d6-407f-a502-e48ef25326c7", "comment": "Malware payload", "value": "bcb6c45d5dcf302df209a8f15659ecd7f06c8af63ae951b87d91f350df8993343c34fa5bc33d6054e2a26af9705cd62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364228, "uuid": "b481c11d-03ed-4fe3-bd37-66fb53aa676f", "value": "T1442833EAE6D07EE6FC3EA93D29BCC671515C5225FD76E11F828600C6D42CE25684B3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364228, "uuid": "6bd66afd-1f45-4d54-b96d-016b723c675e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364228, "uuid": "cf85a089-a45d-439f-8280-92e0230b4c1a", "value": "1572864:xqAiPyZvYbPes9b4SQ4GqfG1LL3Xu9TfHuYDwkYCHsqxctPOE7mBvwTEwRx9i1VD:xqACyZACOb9nG1LqBfHuQwtGotEoKSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772364228, "uuid": "407ba09b-2cf3-4598-9b9d-21aa4ec4214c", "value": 97814092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772364228, "uuid": "35f4e155-9c5e-4cc2-8a38-e8792d9572ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772364228, "uuid": "da225f16-7712-41a2-afec-ebd385cac877", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0072c635-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376204, "uuid": "a3bb2110-dfe0-4b94-88dc-7724f2700630", "comment": "Malware payload (Mirai)", "value": "bface635bd235c663288acbcebf3f354", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376204, "uuid": "ae309a11-9ee1-46b1-b98f-a35359311353", "comment": "Malware payload (Mirai)", "value": "a38fedf7b8d31c7085f96cfd654093c922ba5096e668daa7088568bbc4a206ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376204, "uuid": "7b8598b6-8655-4077-8f0b-71afcd4b3844", "comment": "Malware payload (Mirai)", "value": "54b54b0b48f53cfaba89e964deb2895fa1415751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376204, "uuid": "960badda-3d24-4506-968a-90b1dce680cb", "comment": "Malware payload (Mirai)", "value": "238d0b78a3aade8c03bae48adced98f0099cca63395020c51f218eba984f1275c9807237b8e266bcd29a4546d9bca4d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376204, "uuid": "c69cf47e-5260-434b-97df-d9ba27263bc7", "value": "T1E2E30902770D4F03D1533EF03B7B1BE087AEFD9628B4A580652EBEC992719B22545E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376204, "uuid": "6e8ce54b-28fd-4a2f-bd09-cb130ac56dab", "value": "1536:ceCobapCeiyxAdaWSlx4j/dISqAIZIx4vAiWCtXpO//yVlMDhTmDv6hnsB:jba0ByxqSlxnVI7ifYM7isB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376204, "uuid": "5dc917bb-203c-48b3-be52-f9361906b3cd", "value": 151352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376204, "uuid": "557e4cdb-c027-4fc8-8de4-b33218aaf285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376204, "uuid": "8824da36-74c2-4306-85ef-98496273d3a3", "value": "nppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c480e1b3-154d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772355917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355917, "uuid": "5c9511af-37cb-4c24-9851-88560c3ba244", "comment": "Malware payload", "value": "7fe61e2ceae7ff69836c5c241c479c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355917, "uuid": "963fe31b-a041-460b-85f2-466b93568820", "comment": "Malware payload", "value": "a4459567943b66e76a778883fa7b73aeb9a74c25da740cafccb52c324ac7217d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355917, "uuid": "5c55f2cd-4c09-40e9-acd9-78d1b0ed9800", "comment": "Malware payload", "value": "c9ecbc635558912e131485a5b7bec12f3de3f8db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772355917, "uuid": "6aa4f5ed-7c1b-416e-84b8-de4a6fe63a1f", "comment": "Malware payload", "value": "89b1900802de94729f99930f98907af57163839b683d81eb5b14faa5bd8a33693cc8d98c82d1ef5aa3670f0f45cfda16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355917, "uuid": "d10bf916-6342-4003-b9b4-35572708b398", "value": "T12808D01663A116AAD97BD1388AAB6503EB73B4071330C7DF329C43712F63AE45D7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355917, "uuid": "317fe769-4ee5-4143-b192-0ce6a80d5fd7", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355917, "uuid": "de2b44d3-08f0-4f34-91fc-0a7329d429aa", "value": "786432:a5EosxTUU8XOkBKgP9ZURVujWV1CVuQwoz3f5QtaFBRWYF3eKC3tIgiZ0e:a6oslbkJnURVujK1CBPetalOz3tB6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772355917, "uuid": "6a11c87d-42e0-41ff-a57f-f18edfcf9b24", "value": 80850716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772355917, "uuid": "f925ab52-dcb8-48ab-891d-e376474b4022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772355917, "uuid": "c34c8986-da7c-4b95-b783-77b3d15a281a", "value": "a4459567943b66e76a778883fa7b73aeb9a74c25da740cafccb52c324ac7217d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab1285a-15b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772399012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399012, "uuid": "59806c03-2a83-48c6-a389-4826906c3da2", "comment": "Malware payload (Mirai)", "value": "c9b2692ab40e3064ffb72e6976767aae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399012, "uuid": "44fbebfa-99bc-4682-a4c8-1f49e25901ce", "comment": "Malware payload (Mirai)", "value": "a48634bf8cb346d7a57148a4f33964e9e37bd4e34083edd213c5e030cf946ab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399012, "uuid": "3772f34e-8bc8-4508-962e-af13071b0bf8", "comment": "Malware payload (Mirai)", "value": "da82b082197ff7a5772850b5fb920f4cd252c38d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772399012, "uuid": "539b2963-2cb3-41a5-be2d-a19562e6ab0c", "comment": "Malware payload (Mirai)", "value": "73c89af96b6df30801cf8975c722f53a9468fbf142213bd724784defbe85927f7b1a71091ff8daa77c76cf12bf1254fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399012, "uuid": "bbb08b0b-2897-4c0a-8b3d-ed83450c2fe8", "value": "T15B246CA9BA0F6C41F2C2D3F9DE4C87E13A1B35E3C77689717D1212EDCAA39D95980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399012, "uuid": "38f373f1-4845-4acd-a16b-1b9b467a99a3", "value": "3072:FmZVwS/GOWJPCSDWkusvK7aAPtmZ7ImcOjpbkRLcM0a7oq:5S/VWJPCSCkuva2to7Imc2CLc87oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772399012, "uuid": "a7ee98a3-43a6-4239-9b86-fb48fcbc5b3c", "value": 210928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772399012, "uuid": "3118d5a5-d969-4875-8e7f-095251218d6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772399012, "uuid": "242a53e0-9cb6-41a1-a77a-01697dcf8362", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb62df59-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396812, "uuid": "a5aecb70-25b9-45b5-a235-af4ef43252a4", "comment": "Malware payload (Mirai)", "value": "8b81a96b0314ce507b08dbd0f3d6ef0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396812, "uuid": "9fbda2a9-c8e7-4c46-8c65-b8bd4eea0c94", "comment": "Malware payload (Mirai)", "value": "a4c5f0841861339d13177582c1a4c74ace72f9161adc22920bf6cc76a711395b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396812, "uuid": "4a5bd38c-f0b8-4ba7-ae55-aef25f0e5e18", "comment": "Malware payload (Mirai)", "value": "22a8495a8a71f903f218e9fdb5bd9dc8d2255df2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396812, "uuid": "17f2ba5a-bb24-4738-b755-300f0462064c", "comment": "Malware payload (Mirai)", "value": "e1d843c91d5f2f500af30f28e635b1b7d975e200eda7acc66c4706ba310dc5b2af34eb42b41c8011bedf6298ec31d4b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396812, "uuid": "bcfd985e-19d9-4d9c-be39-faf40cdff9ef", "value": "T12CF3F845F8519F12C6C6127BFF5E828D3B2627A8D2EE3103B9255F2C378795B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396812, "uuid": "fcb4d5b6-527c-429f-b7f9-ff01fa6db126", "value": "1536:7yAZGcqQWHVeVRSFgMxKEntgGcBgACtH4VViNiTexnhUDWIboOYtuiPjLjvlnH9A:7yAGSScEtg/BgT4eUyxnhUDpqflml80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396812, "uuid": "eb6e8d79-8020-4650-bd68-87bc8e901f43", "value": 158176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396812, "uuid": "c4cb8f86-95a7-4856-aa0c-6604b57375a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396812, "uuid": "faba0c85-e4a2-489b-87f8-c723a518fb8d", "value": "csk_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3142ea06-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772385306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385306, "uuid": "cd7d9b29-fb54-49d5-90c2-ff1a23c61feb", "comment": "Malware payload (RemcosRAT)", "value": "1b73f899c43ad812a42143e95613aabc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385306, "uuid": "b8f9a6b8-79fb-43d2-b3a3-fac2f92f01ac", "comment": "Malware payload (RemcosRAT)", "value": "a517b979e26b414939bb4b35fcfa6526994e52acf7fc4b8ad6ec2e0232108442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385306, "uuid": "dc66f22b-4957-4fb8-8917-b87556a22e7b", "comment": "Malware payload (RemcosRAT)", "value": "ddae13a0f7556a6447905eab95fcf5abb0a01e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385306, "uuid": "001366f2-e5be-41c4-8fae-df08725caf8c", "comment": "Malware payload (RemcosRAT)", "value": "a02e344f3f50e00f88edeb0821812f7fad876a00016f8f0c249c1ae5f1c6e56bd67abcd3a64e38efcc8b83be9d84bce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385306, "uuid": "8a5ec659-ce0f-4626-90f5-38053653e053", "value": "T1727402047B90E63BD86406B00C3FD6F69BB6FD64AC95138B6780771EBDB32859C0A365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385306, "uuid": "4419c6de-0d1e-4eab-9d81-89c6b3a2376f", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385306, "uuid": "41d60c75-73b7-420b-a9a2-77c23b72e575", "value": "6144:PR+xXo64cQNmmAw4dijjvU1F4ojPsQt00nEiUtjORD3:Jdkbw4dij4j4ArnBUx0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385306, "uuid": "8e71bebf-cc1a-47ee-a828-91c3959e9799", "value": 347485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385306, "uuid": "49e3194f-1fbf-4741-975f-f13d4bcaa86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385306, "uuid": "ac4fb197-104b-4478-b3b8-c3bc9d10c9f9", "value": "1B73F899C43AD812A42143E95613AABC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0543ac-157c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376202, "uuid": "eb5a18a0-a945-448c-abe6-9f36e5c451f6", "comment": "Malware payload (Mirai)", "value": "1e068dbb6e38ad7cb4042f9c14ead379", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376202, "uuid": "c877766b-d35c-4e19-9fe6-fb0cd09f5fcd", "comment": "Malware payload (Mirai)", "value": "a5485cfa9d017187e5bf027fbf787d6c6008d395c7bde646274b12b0c52d5cef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376202, "uuid": "5424bace-2b7f-4aab-87f0-63a8ce7d9f02", "comment": "Malware payload (Mirai)", "value": "b7b9f7a2101c794500ece48fba37dc1a7af9f946", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376202, "uuid": "e2b966a9-9622-4034-a4db-f6f40aa8707d", "comment": "Malware payload (Mirai)", "value": "70b5c22422a67bdd3d955a1f21e0a1bc88ba7f3cedd93e30e137361ef835324f6443d481dddbf252b9f4c6f892ec0ede", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376202, "uuid": "56f50296-177d-4db0-a6b9-df4552e67581", "value": "T17F24C5067F919EB7C86FDD3706F68B0128CCB45725A43B3A3670DA6CB91A54B09D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376202, "uuid": "52c1e47e-a59b-47ac-aee1-c45cbf0d5940", "value": "1536:zJrri2wB/BsyU/0Z8/SnxvhjehFGZyInxNcjb9rEtGESG8fqsZyh83ZCNNmaQyjp:z9r5wB/40+Ojc8nMjbG1WZaQRUysDHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376202, "uuid": "0e40a354-d50c-4f3a-a629-54decafb6a12", "value": 217892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376202, "uuid": "a91f9bb9-efe4-44a5-a6fa-b38ac3ea3fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376202, "uuid": "c78b1fa9-567a-462b-b760-d115042f0ae8", "value": "nmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb188d42-157c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376195, "uuid": "d11b6c65-5172-48c7-ba3c-ed41664f1525", "comment": "Malware payload (Mirai)", "value": "887c762e6d00c43b3ecc6ce91a9ce0a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376195, "uuid": "ee38425c-40c9-47b4-a2a0-5abb32759492", "comment": "Malware payload (Mirai)", "value": "a58a9eb3e8afefce649b9cb85ea28b4431f88137a8398b48eaf5987228d58431", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376195, "uuid": "450d7e48-ef5e-44e3-b105-aca1e5c78086", "comment": "Malware payload (Mirai)", "value": "c4dba496861017d6ac4509370710bd7e808bd34d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376195, "uuid": "cc75b487-2435-4540-812f-e02ad7164d7f", "comment": "Malware payload (Mirai)", "value": "dfa48742430d961a1026fa1f60033d9d1b424a33cbc04854dda3a515076465ff6e70be3ab28f53adb8609882b9234813", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376195, "uuid": "78be618f-04b9-4f60-a57b-8107f460ca69", "value": "T1C1E3F746BD419F13C6C721F7FBAE42983B166B6DD7EA3103D8256F50378A4DA0A36212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376195, "uuid": "758858f9-ce1b-48b2-b99c-22a5f2f2f7ea", "value": "3072:h0bfTJL1ANOPN3J4gbn73Y/WIelo/Qbz:WfTYNO13J4gD73Y/Ws/Qbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376195, "uuid": "fd6fa583-e425-4d87-9350-a15df993877c", "value": 147088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376195, "uuid": "d4ec15d7-9294-4333-a3cb-26c2a9d846c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376195, "uuid": "edeaa7ca-7223-4fa1-bd4c-cff3d8c286a7", "value": "narm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112e2343-1566-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772366354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366354, "uuid": "94d0abf1-e666-4bb7-9113-269e92e27219", "comment": "Malware payload (SantaStealer)", "value": "46672384f3eb935204c3fb925c883b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366354, "uuid": "8ca2ac46-c5fe-44a0-8332-c86496cfbe6e", "comment": "Malware payload (SantaStealer)", "value": "a68fe3f844147e5a1387e9563363e8288ee208ed8fa0b86223af8ab77d0c144f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366354, "uuid": "c04dcc17-eb4b-48be-b7e1-e2c273d39d3c", "comment": "Malware payload (SantaStealer)", "value": "548af9fe9506a94a4ce72a64f282e2d7e4e48f23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366354, "uuid": "fb3aab70-fac3-41c5-a4fd-91a4fd570aac", "comment": "Malware payload (SantaStealer)", "value": "b98b657a8e638facfdf836a1d333af2f9889fbf56288d57f3983af5ef57d0104e50fae18350b4dca4d773c5b68e638a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366354, "uuid": "da2deb3f-5cc0-47cf-846e-4f40a7c24abd", "value": "T16BF6271010D96607FC3EEFBD85DCB6444F7AB2A57722EA389B4109E90FD1F18C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366354, "uuid": "061a35bf-7087-448a-b53b-b83e92450d6d", "value": "196608:G0c1TXSPO5+Nu+N5PbBUfbEVMGIMhSyST6uMdoDf1byl2SHhgJ8F+eB0uL:Gx5dOPbBsYcmuMA1bWvJNJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366354, "uuid": "644edd45-5d55-4eca-84e2-e131aea48e2b", "value": 15973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366354, "uuid": "efc1b637-b959-479e-8663-f28f525a1c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366354, "uuid": "5822ad69-c5ab-4d31-84c2-ea19448efe76", "value": "Solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e368d386-156e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772370143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370143, "uuid": "ed928405-36eb-4f45-b4d9-53c39178e972", "comment": "Malware payload (Vidar)", "value": "5c9fe278491bdaedc9c2359258cce9ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "expits-com", "colour": "#54713A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370143, "uuid": "67613da3-c3f0-4bb1-854c-d65dfc02dd88", "comment": "Malware payload (Vidar)", "value": "a753c36ffb828df202ea29e299710b1fe59608dfda2cee6675027bd7ea4325df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "expits-com", "colour": "#54713A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370143, "uuid": "31165cf8-6f6c-42d6-91d5-db04c085cd24", "comment": "Malware payload (Vidar)", "value": "f12d3c932aae71ee5ba733cb84cd7183b8d8e965", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "expits-com", "colour": "#54713A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370143, "uuid": "3b832a4a-d326-41a3-9bcc-a83abb6b4859", "comment": "Malware payload (Vidar)", "value": "59bcc45e13ea6bc3e293cc1a12416f998d4570f87c7a4a561386ad7a59aa776efbaecda1ab0e06dc376192e481d416e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "expits-com", "colour": "#54713A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370143, "uuid": "7a3409bb-06cc-4f8e-b9e6-a10a78551339", "value": "T117D56B17AE909CA4D46E9375DCBA22867736BC58073333D31E167E742EF26D1583AB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370143, "uuid": "da4d9400-cd8a-406c-af3d-dfe3c8baa066", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370143, "uuid": "beb5eeb7-38c2-4a77-93e5-30c953260f5e", "value": "49152:eJ5voumJhwqWuaCihnUGTeU7ha0OwknZhaza:eJGNzpN/Qha0Owwaza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370143, "uuid": "2c000033-8640-4acb-9fb3-ebfd17f77e8b", "value": 2774616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370143, "uuid": "ac1d9533-9929-4df0-bace-467d790ae519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370143, "uuid": "3da0879b-a368-443e-b053-3f2a35a611fd", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f066587-1566-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772366350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366350, "uuid": "d2c2bbc7-fd7f-45be-a623-95303818c551", "comment": "Malware payload (Amadey)", "value": "9d5e0274ae3fce4ccf671593ed82f12e", "object_relation": "md5", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366350, "uuid": "cb96434e-8305-4749-96ea-68ff8a495955", "comment": "Malware payload (Amadey)", "value": "a7ca1f6ca408c5cbe644e3b92404e5389abdd212423b83168c9b69201075774f", "object_relation": "sha256", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366350, "uuid": "35583faf-c50b-44f4-8077-f433d4735eeb", "comment": "Malware payload (Amadey)", "value": "48545094a360b1abee09d064c5868c9056a73a25", "object_relation": "sha1", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366350, "uuid": "91f0d661-76bd-4240-90f1-faf48d9e8763", "comment": "Malware payload (Amadey)", "value": "ba62c2f0ab17cb4b50a45f03ed75140df471e2e42fa8681415f7b7a55b432202b255c54bdc55d2cebc91470496b4203a", "object_relation": "sha3-384", "Tag": [ { "name": "77-238-228-60", "colour": "#686A1D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366350, "uuid": "69c989f6-c974-4d82-b902-a517a095f9fc", "value": "T178173320AB6915E7E3F6703A75319107A450B2F8DE23FF8E768CD1FA46D37D29262901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366350, "uuid": "ae5e6a5b-8f10-43ad-9eae-41abb87caa98", "value": "393216:cuPkUaf0U0l5ovhqgoIidJwAwNFz7IP3XUyYjdh/r7bs1dQnSOfMqMbEaltGWIr:evml5oJxL2/wDm3XBo/r0DQSOUplqWIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366350, "uuid": "636d7190-9e37-4c8f-8ab3-f5ab490f35ed", "value": 18967048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366350, "uuid": "01f6b075-87e8-4fa3-b6d1-f750bcf67ff4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366350, "uuid": "841896a9-6cbc-4295-801d-a1646a3b914a", "value": "li.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40606073-15aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772395639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395639, "uuid": "33df673e-45bb-4074-8a39-e1312702ff0c", "comment": "Malware payload (Mirai)", "value": "56c8df60b9535a6a0430141c3f871fcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395639, "uuid": "8dd235ed-252e-48eb-aea2-e2c361fb1eb6", "comment": "Malware payload (Mirai)", "value": "a7e834523929fca403b482b6da5781f762bad55ad9c3732ff6debbfe2b7c3750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395639, "uuid": "b10d1e43-2332-4531-bf88-43a092d9018b", "comment": "Malware payload (Mirai)", "value": "32a48c373cda0d5034b764e43d764d2dbe82b3e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395639, "uuid": "52e998e8-e4ff-405b-ba11-899589592caf", "comment": "Malware payload (Mirai)", "value": "2c27cd0ccf69d10c23ccb6c5fadd0fcfe7a810a2b3654e7609225163a2a525428f62178e84a6d5a54b755d7d1e1be2ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395639, "uuid": "82ecc82e-2894-433a-9e63-835e677a067c", "value": "T1C9145B46EE890FDFC46BCDB08AAF839B2AEB569B48D1F1F0543C8C0C795D19A45D3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395639, "uuid": "54bb5692-5610-42e1-ba20-354a92ca7256", "value": "3072:sH4YuMoqp2Cum/Y4i87GJ/dU4/o7CijgCrL+ui9h5eVlyVp5WVf0s7RpNq1:d/m/liD/3pcLq9h5ejyVpGH7RpNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772395639, "uuid": "c015f3de-2d8d-42bf-b3c9-505f272b4d4d", "value": 201132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772395639, "uuid": "5e723a4f-979f-40c1-baec-4634002e7be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395639, "uuid": "c1e2f2c6-64af-41e5-8557-9717ecf8c955", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6d80eb-159b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772389510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389510, "uuid": "85ec955c-d06e-43fa-a83f-b989058f64d1", "comment": "Malware payload (Mirai)", "value": "510cf874be4c232871511646e0dbd604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389510, "uuid": "1cdfbd9b-2cc5-4ab9-a96a-c931e6543f2c", "comment": "Malware payload (Mirai)", "value": "a939048e4374176a6259a19da544423cdc838e532a978fbb2508fefea8e5c88a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389510, "uuid": "2aacffd7-00f4-446e-b7a3-a00dd6e75791", "comment": "Malware payload (Mirai)", "value": "1187ad056d16796ba8bc11accca23cef2efdc3ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389510, "uuid": "2af78c56-c456-4a19-b2f7-2eb6540adad9", "comment": "Malware payload (Mirai)", "value": "cbf978bc2e52d7e5cad5cb2b9fb60a8ca966a0566470fc37719e820136e6c8d0843ebff15e7e1579767ea63df62c78c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389510, "uuid": "9b76cd8c-f97a-4bed-a5f4-c4a811b9a12a", "value": "T17CE53337D40338D7ED41716DFE2B836A5510190FECE2FE8D6606BE5AF6B98450D2A213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389510, "uuid": "a3104a6d-e63a-4e72-92e9-5fa1e7974169", "value": "49152:FKgAmhqLEK9IvztjyVGeguar2UUYwvwYzyQWV/yxpP475L448cOy7R2yGxq3djX:FKShqLEK6jyk5J2V3vx2Tan4h4DyAyGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772389510, "uuid": "409b3350-4f8c-492f-9e4b-3e916664fdda", "value": 3077332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772389510, "uuid": "f186e513-cb1c-4c89-9d2a-90c08514f3d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389510, "uuid": "7f073291-1fd0-4ccd-ab72-e25cefba9abd", "value": "fullgc-linux-x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9525e99-1546-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772352919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772352919, "uuid": "959cc9bb-1d27-4df8-9388-9295d0f89ddf", "comment": "Malware payload (QuasarRAT)", "value": "534239a3c86b8ffb0bef0cc777661d06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772352919, "uuid": "8812a9e4-9ae1-4370-b8fd-008d46e9b430", "comment": "Malware payload (QuasarRAT)", "value": "a93a1a1329d86384295dd87e4a5b4595afcfd8259ee43290416623fd17949769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772352919, "uuid": "2ff68d38-58d3-41b9-8ce5-7a5c679285be", "comment": "Malware payload (QuasarRAT)", "value": "ff7ffd7b2729784370b7122eeef58776b07ce546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772352919, "uuid": "c7083465-f9cf-4d33-a0b3-f4589ab9493c", "comment": "Malware payload (QuasarRAT)", "value": "b3ca8722e30a91809508ab7948886ee8185e440bc0923eb0ce576bf78869d1e5e490eb3173ef63c078ddcf102f0931ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772352919, "uuid": "9a0f8225-eaea-4604-aab8-84ea44a5900b", "value": "T114B423C6B3155985D07563721C3B839418287C72DA6043F236EEF737AE36B24A5EFA12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772352919, "uuid": "becf4d65-ac72-40d3-b4d5-5f4ef6da3f09", "value": "d68d50e561120d9fc7c0080f8c51969a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772352919, "uuid": "604b548b-cbde-43ab-ad4b-bf9c621843f3", "value": "12288:/ftnDqWGPKxyMn9Ad9uc4IvCPTyRIcUqi5Tty904L:tD3GyxyMn9S9uxuqXqi5JyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772352919, "uuid": "cf925d8c-6912-4144-ae12-6f3e844f2724", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772352919, "uuid": "e0136842-51a6-4b22-986d-7dc01d088f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772352919, "uuid": "59e3c1d7-f01a-4a8f-b452-39ff48923255", "value": "534239A3C86B8FFB0BEF0CC777661D06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7021a4-155c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772362324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362324, "uuid": "72a1aeb6-8a5b-41bf-bbfc-2f499ecdefa9", "comment": "Malware payload (AsyncRAT)", "value": "556c49b40ec4764b781d6d6eb9f97edd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362324, "uuid": "fd6c84ea-e698-4433-b8b1-e452d89c66a1", "comment": "Malware payload (AsyncRAT)", "value": "aa4b643b0cf8f91532272dc7a1c2426f0da0aceeaa653831ad0daf55df2e6eef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362324, "uuid": "add9a7b4-dad4-4988-916f-c74dec111dfa", "comment": "Malware payload (AsyncRAT)", "value": "661a9533ec7300f2012f2ee3c6506dff0a7952bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362324, "uuid": "e95426ef-6ab5-414b-b492-7fff6db7e110", "comment": "Malware payload (AsyncRAT)", "value": "8cda6bb2fe7a8da3a0e9c96e721b9369e713faef16b7d7ba1cc05d2afb6646f758bffe617f58c27f15e65dc08707f44c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362324, "uuid": "1a4fc67a-59de-4069-811d-cf76be575d35", "value": "T1F931C0552FDA0329D3B2C63B54B5E3824A33B950E9738F5C4280D28C2C65600E836F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362324, "uuid": "6939da09-969f-4c45-bf28-af24e84e4f0d", "value": "24:8VZJI5UmtJ1TAY8PA+/2PyJi5iFfa4A+U/FIP4I0aA3yUUXQaR3+9h/LnU+Y+/vm:8C+1vJi51NxfIPzXv3WzU+Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362324, "uuid": "117086c5-5da3-46e3-b03b-b04605046eb5", "value": 1660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362324, "uuid": "d6fb26ba-d3db-402f-a07f-1a505880050d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362324, "uuid": "2eebc7a5-61f9-4d62-8ebe-c59710ae0480", "value": "64thServices v24.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef9caff-15a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772395207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395207, "uuid": "fad1df19-19a9-4104-9423-2fd2fdd6ce8a", "comment": "Malware payload", "value": "848b9aab506e7498e55e0184eb4fdf0f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395207, "uuid": "74823768-931f-4a53-a0d5-8092fcbb07d9", "comment": "Malware payload", "value": "aab593a7bf632bc643bd262730edb28b9de0e78a77d88beb8bc23978a2598fda", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395207, "uuid": "c5e4d4f4-08d1-463b-b987-ff2f55e7d436", "comment": "Malware payload", "value": "87a558a02928181a13253213ed605bb6b46ec047", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395207, "uuid": "7852b5be-7b67-4a7f-bb31-509ebbf4f700", "comment": "Malware payload", "value": "c1eb6b7230615d45c280c6bccacc58523b99662a53d1375f3a4909eb4ad2eb46c38f06c616cdab4f811c0718b570e09a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395207, "uuid": "2f15c7f0-7074-4291-a965-0c2b83d683cf", "value": "T10241638EB1B0428186CCCF4671F14DCA77069693F1F46A72ECC12E7B8499D4835ADAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395207, "uuid": "1f9a1d34-9ab9-4259-8a6c-e087d7b70c04", "value": "24:PDdo612OvBM/htm1bKO2wM6fEo7egKXJl4/H9:y612B5o7ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772395207, "uuid": "bf1dd23e-9c1c-4b03-bce5-b39bbd17482c", "value": 1901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772395207, "uuid": "4f9f22cd-f538-4a82-870b-7c29c0286328", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395207, "uuid": "402864ae-ea05-4a49-869b-f6dfd6ae42fd", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93649979-156a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772368290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772368290, "uuid": "64f94888-97de-4bf6-9ecb-32bfe2a22144", "comment": "Malware payload (SalatStealer)", "value": "498103ce351e5dba8a5e1c3446c76a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772368290, "uuid": "e5bc7216-0af3-4fa1-8a74-3531a71d4729", "comment": "Malware payload (SalatStealer)", "value": "abe5b67e7bf24a445d31e9070c931931ab80062d4c4e08d290bdcb88f29d5a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772368290, "uuid": "15899670-32b3-4dec-aea3-325db8251c3b", "comment": "Malware payload (SalatStealer)", "value": "b84a403fc8091a6ee94b327542139191759c2366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772368290, "uuid": "02906eaa-1285-47ed-a156-f121f9f50436", "comment": "Malware payload (SalatStealer)", "value": "7a3117d4d65c2c0537429a28b7387965c9b13e75f553e0c935e688d82d03c1a4d4c0b4c04984beca1c34f4dab2764478", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772368290, "uuid": "46a8f2b5-c56b-4e54-9b03-903a996aa14b", "value": "T19BC63355A58404E3D9BBC63D8473120DEF62781407B2D68F13D06BE72E677C22E3AB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772368290, "uuid": "c7b34246-2eac-4ad0-83eb-010c9d6110d1", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772368290, "uuid": "0dd2397d-f383-4a26-952c-0a3a08147b9c", "value": "196608:70jxoiQUqHfZcgO7y09cTLowtSH7zj9AKm6gUU8gBk6vdQmRsIkaqdVTVjMoHbhX:riQjZO7y6cLXSH3GH6Yk4dQ3Iwd/FHtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772368290, "uuid": "e18554c9-0a19-4838-8776-6c01bfe95e32", "value": 11848711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772368290, "uuid": "af5ff52a-cb86-488c-8acf-57214163ed6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772368290, "uuid": "edf93e4d-4eee-4a6c-aa6e-33a2817964b1", "value": "winx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043b6111-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376211, "uuid": "15315585-90e7-4e87-b757-897d13161f49", "comment": "Malware payload (Mirai)", "value": "cfab3a0047f86e5e00d3ac7695dc6dd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376211, "uuid": "7e34f5f3-649a-4db0-8a0c-ffb32f2dca94", "comment": "Malware payload (Mirai)", "value": "adfc440947f2f3ee41d020dcdba02af9f7261d2b95e35a883a12d6e271f3518e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376211, "uuid": "4baa9287-93c5-400c-8821-1779e2ddf77c", "comment": "Malware payload (Mirai)", "value": "270785952f211703a48069fb8e2c5274cd726067", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376211, "uuid": "e24e4bc2-48b2-419d-a0d4-1a1930391995", "comment": "Malware payload (Mirai)", "value": "385749b2990d8a45398eea063390f7c313bc59a6ca6c1b44b14fb06fd54eaa7d3b66dbf1d881012970974bb8b8d3225d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376211, "uuid": "f7524e9d-b47f-49a2-a105-b698cd90574d", "value": "T1F424641A3E12DF7FF55D867047B38A30969836D62AE1D585F26CD70C1E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376211, "uuid": "2628b8d8-1795-4426-85dc-96578a0f5624", "value": "3072:c24lFJPZJwO4PvzlFQFWo8NWdz0OMiKE1HjWGrCXYWvcJG:c24lFJPZnSvzlF+WKz8iLNRrCoWvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376211, "uuid": "3f0ab747-fb45-4374-aa46-cb8edf8626e8", "value": 216036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376211, "uuid": "0acf2947-c8a6-4245-a851-10ee5a334dcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376211, "uuid": "846741e1-1d50-4375-9b4f-2ff809ef326a", "value": "nmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0066a961-15ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396820, "uuid": "c60e3d4e-a26b-4c3b-bd6c-87ccb621e85d", "comment": "Malware payload (Mirai)", "value": "31ca2165701ac9c0514ad55993aae40a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396820, "uuid": "84be908c-50c7-4371-a580-0b7ddbcdb900", "comment": "Malware payload (Mirai)", "value": "aebcfce39abd1b984ed8e443bb4b588468a8de26275e190eb2f90d3de5dda158", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396820, "uuid": "42cfef4c-8447-47eb-a9b2-c94d3266fc8e", "comment": "Malware payload (Mirai)", "value": "aafc496b102f8a02e293ca36d5dc5541acaa18d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396820, "uuid": "8351e53d-8d21-432c-832d-bafc99036a97", "comment": "Malware payload (Mirai)", "value": "d2cd54932dfb4d508ccb5a856ad78a5143d60d9927c922c2f9dbe3d7086b6eca0b54ac86dc38762a2aa4523cb95a374b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396820, "uuid": "6e420f67-538c-4d21-ab84-c41c61ad167b", "value": "T18924C70ABB520FBBD8ABCD3706E90B0129CC655726A43B393674D72CF54A54B4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396820, "uuid": "c59a96a2-4087-41da-b4df-32cd683a7f0c", "value": "3072:AS0zqhchKAGVCGuMCcTsPbXMquhO5UgINZ8rC:AS0zqhchKBVu9PQXuUtNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396820, "uuid": "133f3e99-421a-4776-a0d2-29e39a73dd2a", "value": 209912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396820, "uuid": "c9407b04-b41a-4845-b854-132ca7fbd955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396820, "uuid": "c148d3d6-e062-497e-b7e0-9e497087c86d", "value": "csk_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd19a1f-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396814, "uuid": "4ea2ae1b-2192-4c25-ac3b-463d33248afb", "comment": "Malware payload (Mirai)", "value": "70fef2ec4f1965cb7932c5e1304a6837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396814, "uuid": "f561a117-d625-4545-a0f5-a53c2144e227", "comment": "Malware payload (Mirai)", "value": "b0a2c463408d9238b66c3f6c34872714a6a7c968ec071ea727ca4ed7cd4bef1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396814, "uuid": "d4ad4fa4-b93a-408b-886b-18441d6ce336", "comment": "Malware payload (Mirai)", "value": "68cacaf67dfb79c3f93ef3c2d355128b458cf467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396814, "uuid": "79cd26ba-f126-4a1a-a944-9b4a7de0438e", "comment": "Malware payload (Mirai)", "value": "b80b22fd6e2a6c2e46006e0d99455e17cd60ded82970f2c8a332deff6200c753e115c39cd7bb77c1ff25a47027304c0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396814, "uuid": "f56986fa-df66-4675-b5b1-7fddee3e931f", "value": "T123F32806B30C4947D2632EB03E3FABE193EFAAD129A4B644391F9B8D9171D321545ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396814, "uuid": "04675692-0ec2-416b-a787-76163ea98443", "value": "1536:m3RkFHmUESH+dO/RLoTcKZsxc4MJcqKrOTlQNZLBEHbYWvAwKMuZVOavGcluqD1y:m3yons+RZsxGnihNRBp/wg4g8i2E+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396814, "uuid": "908b923e-01a6-496d-a6d5-47c0555c4029", "value": 160476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396814, "uuid": "072f0867-fe3c-49a4-b823-880b21a5c2a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396814, "uuid": "7f2f54e6-78f0-4717-98c7-047d30f80339", "value": "csk_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab3b27c-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357538, "uuid": "f4ffd8bb-077c-479a-ac03-f3402da32fab", "comment": "Malware payload (AsyncRAT)", "value": "a005b3b27bc374ac40b1330fbd634ba2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357538, "uuid": "189f4a4a-caa9-416c-9099-5f6285c2ede4", "comment": "Malware payload (AsyncRAT)", "value": "b1362f1a581b3a46d3083cbf3ade97f6ed790d78fa9d079ddea1fd1d58163400", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357538, "uuid": "2082305a-bbad-444d-bd97-88524fb8c27a", "comment": "Malware payload (AsyncRAT)", "value": "31da8760af45fb6df5a53a058990cc52902ad1bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357538, "uuid": "0ee41aab-cb0f-4ccd-b35b-5a29e62a9372", "comment": "Malware payload (AsyncRAT)", "value": "22342bcd1ab45915d9c9fb26793c59e14960d532bb23a151c56a5b637a22f315186158419e8fdd74a1c90cb810324d37", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357538, "uuid": "dc079143-30a8-4e68-98da-7b0302cdad56", "value": "T193F25B0573E58665E1FD0BBD5C3686044376FA574D22DBAE2EC490AE1A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357538, "uuid": "13fb28cf-737b-40c0-b2d8-6834fefa2602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357538, "uuid": "57db76c0-fc00-4b68-84dc-f3eee05b34f1", "value": "384:DfMTc/PLK1rXa9ashOlE1bdcWOe7X093bayseHQxnC7O+WmlIuufGfrfCLUWWIEN:zic/mVXa9thx1hVYRbJwB+WWJzQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357538, "uuid": "efae0259-0071-49f0-9a9c-cb54d842811f", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357538, "uuid": "82f3696b-7c52-4108-b371-6fc6eaa04771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357538, "uuid": "0dfbc2f3-df05-4c96-8131-4fa90d4f7e4c", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ef7d21-15ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396823, "uuid": "a6ab953a-d727-4db2-85d5-decc69e3e226", "comment": "Malware payload (Mirai)", "value": "857444d944b2bccf7c61c694e8ea7e30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396823, "uuid": "befec95e-0de7-4dba-bb53-46e4df26a5ad", "comment": "Malware payload (Mirai)", "value": "b140160de934a651b23d7372856bcd3cf2cfe89041f35f173546f25d85c813b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396823, "uuid": "ba7efd6d-316b-49ba-9ce5-5e6fe07a4c7e", "comment": "Malware payload (Mirai)", "value": "a865606a7fc8b1b58a9e9c348b5f1963a62a58a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396823, "uuid": "4800234c-c312-467d-9e9e-d6932a85ab11", "comment": "Malware payload (Mirai)", "value": "ab9f47855e818058178a423db20be4f620cfd737c4f90102aefb1207f998ba0a7100e8cd64e43f1025acaa9c6cc21ac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396823, "uuid": "c0d49322-ae6e-438b-a9bb-6bfc689f5bc6", "value": "T1CA43E765B892D957C2D01376BE5EEB8A332573E4CACE3223F9255B2C368650F0D17A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396823, "uuid": "fe29b890-b971-4d51-a800-372fc24f7973", "value": "1536:jidUSnZGNg/G5/hGKvyE7gu/c/mn7ZkR5QRw8:2dUSZGxcQgzmn7ZkrQq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396823, "uuid": "a2657a98-7a36-4e30-ad1a-e0be16e710a2", "value": 55888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396823, "uuid": "e55ae17d-8934-4425-b90e-7722feea92f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396823, "uuid": "007ddc70-f588-42af-b4fb-b520e1e669fa", "value": "csk_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597bfd22-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357456, "uuid": "d2de1989-610f-47c1-bd45-8fe891660f36", "comment": "Malware payload (AsyncRAT)", "value": "a5a6fba167e0060619974f42126883c9", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357456, "uuid": "97fa926b-e0f2-474e-b140-ab5200ee6582", "comment": "Malware payload (AsyncRAT)", "value": "b3d3677077201a665fb54185b07ae8aa8095c9bd35b0c8b860c0bd8b4d36e66d", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357456, "uuid": "5592cb7b-ab4a-4afc-a81c-7b5459063ff6", "comment": "Malware payload (AsyncRAT)", "value": "3139eb8fa328d7fbe1494d357dda88a2e77cab56", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357456, "uuid": "ff2b5d17-aa97-45b8-96ae-acc02ec00773", "comment": "Malware payload (AsyncRAT)", "value": "b20e0c5ffbe052aaf09025ebd2e01227f0505a7592da576eca875d466c8f1c175b619b6e4335cf4e9e225ad7acfd0603", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357456, "uuid": "61eca676-cad3-4167-9c6e-03977eef036c", "value": "T18EA53374B9242C65649C280052BE21DDB8680CF7790910ABBF9BDBC59E51743CE9FBF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357456, "uuid": "48e9fd32-356f-487b-99d4-7520fb0d38be", "value": "49152:IwfM1VMHhRjehRALiZfKOpmf7qPj/v5ZTA33ikOf5q+xF6abWkosUYaXa6ttaWvB:1OVMTWAudpmfCj/v8CVA+L6AUsU5Htdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357456, "uuid": "3534e384-9d82-4da4-8def-67ebfc727bcb", "value": 2239948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357456, "uuid": "c0d59ca7-e3e7-4129-9e9c-97a3e59ac831", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357456, "uuid": "a46f9d34-47dd-43d9-960d-effb6445c2c0", "value": "b3d3677077201a665fb54185b07ae8aa8095c9bd35b0c8b860c0bd8b4d36e66d.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e845d13f-156c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772369292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369292, "uuid": "89fbf87b-3d00-4219-97ed-f916f75ea3b2", "comment": "Malware payload (AsyncRAT)", "value": "f1e1092b91c902cee35b916d5f4958b0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369292, "uuid": "ef22b913-8936-4a10-b830-ac0e705f2f1b", "comment": "Malware payload (AsyncRAT)", "value": "b48bfaa84b2a25baeeec77e2e11151f0bf24e4a029f1b33102d752e91d4f21a5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369292, "uuid": "b65d351d-293e-47c5-8284-9b9885de9c24", "comment": "Malware payload (AsyncRAT)", "value": "20f035be688a112f3ef777e5d43517e85b23f0e0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369292, "uuid": "0fe47539-c35b-4e65-9c3c-69a3e81724b7", "comment": "Malware payload (AsyncRAT)", "value": "695e1dd7bcf7ead9f8e372edcec7e8315289eb99a6da1233152f735fdf30be9b39a9032cb28faa37618c2c30a7a45b78", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369292, "uuid": "0f3fad8f-cdbc-4d28-932c-e302e6deeaec", "value": "T1BFF24B0573E58665E1FD1BBD5C3686044376FA478D62DBAE2EC450AE2A237C8CF14BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369292, "uuid": "b45f59cd-ffea-4c2b-a154-c6ba3e372561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369292, "uuid": "85a7e675-500b-484b-bd64-0e9419293725", "value": "384:aMThv6M1S/y1IfbwhOlE1bdcWOebX093bayseHQxnC7O+WmlIuufGfrfCTjWWJc8:aihvbI/y1Dhx1hV4RbJwB+WWOhQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369292, "uuid": "64015cd4-528c-4ce6-9fb8-2c3ea08c4248", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369292, "uuid": "ebcd019e-d0c5-4a29-9fd4-268592ce36ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369292, "uuid": "c5ee5c95-bacc-449c-9109-d43a2e79a674", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a772d55e-158a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772382068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382068, "uuid": "7a3d6931-ce5f-413e-9fe5-c9e0ea6d4150", "comment": "Malware payload", "value": "2d85d5b292d86b2755f0bff206f62813", "object_relation": "md5", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382068, "uuid": "42b48cee-1ae4-4b46-9a45-9c333cba8e7a", "comment": "Malware payload", "value": "b539436f5f74740facb9b49139b6ac672e599f5b169dfcab1fbdd633436f881d", "object_relation": "sha256", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382068, "uuid": "3181584c-9d24-485c-844a-dfe6be0024ec", "comment": "Malware payload", "value": "758882bb629644ec5182a9892666bf5f10f772fe", "object_relation": "sha1", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772382068, "uuid": "728dd932-9834-4cea-9dd8-37c204eb9c0e", "comment": "Malware payload", "value": "8a3bac294c42c8e231b407596d3cd796362be18d5971e445759e048b52a4e94ff500105c2d6ef37ca2e5be83c957a4b3", "object_relation": "sha3-384", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382068, "uuid": "5539cc31-d1b2-4c74-8368-dd28cf10ce2f", "value": "T11B630282BEEE59E2DA1382727912CC5FFB39B072D35FDA64625C43E7154C2905B0B289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382068, "uuid": "a19fb8d8-99b8-4c52-97e5-8e11763e601a", "value": "8efd347d961f811985fc96a4b4c4393f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382068, "uuid": "e132e69c-b0ca-43b0-99db-de21cda0e07e", "value": "1536:CsfX0J9aO9zpnIoSs92y60bGZ57/gsFSCSOcw0RdRayNRJR:t6UkBH3IZ57whOcF7Ray9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772382068, "uuid": "fc3791df-9645-41a7-a6cb-60599390007f", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772382068, "uuid": "23de4234-a145-45dd-b0f0-6e67f8a2f639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772382068, "uuid": "6278ed07-1549-4697-b123-44949a48385f", "value": "Fixit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6935a984-15aa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772395707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395707, "uuid": "cf6fb0cc-6fc8-42c7-9742-7af1fb251cdf", "comment": "Malware payload (Mirai)", "value": "0acbd82fe0fe4f8ec2d162a27bad0b11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395707, "uuid": "11497681-3b69-4aad-a020-5c557a6411fe", "comment": "Malware payload (Mirai)", "value": "b620369eb25974c90e063afcdb6c529ac474f155809dd4d59c56593045931bf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395707, "uuid": "1adddc06-30a7-449b-8382-e8b03823c090", "comment": "Malware payload (Mirai)", "value": "303e06cbb824c6cbe7bfefd2b4c449e0820373e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772395707, "uuid": "e052b4b7-142d-4481-96e2-223a9fcafb22", "comment": "Malware payload (Mirai)", "value": "c90c2729ce413f8302cfe3ed50fb4fcb092cac4c88fb6932538961c402ad9a8343575b979bcc8dec2396d1b1366b5ad0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395707, "uuid": "209f3fda-0ce4-4172-abad-2994e1678035", "value": "T124134C2345F9AB0BC6E4A77701E383B290FE6B806050174F7D1A4C5EFEA63416B6A3D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395707, "uuid": "3be26515-674c-4497-a153-b1114982c48e", "value": "768:Hi375vu9fDYtMfravAp5VFc1aZpjegBeGID2Nomdc:c7cYtMDav87c0ZDBXob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772395707, "uuid": "3d28c0be-7494-4fc1-9ee8-7e1d2964632a", "value": 43744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772395707, "uuid": "14379a7b-68ea-49d9-9e76-576de3738756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772395707, "uuid": "e04a668a-4d1b-4c61-b587-453ba2e10c22", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aef7596-1577-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772373672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373672, "uuid": "1d969940-8f21-45b3-a0e0-5290819975c3", "comment": "Malware payload", "value": "df53bdcee28da26a33b90c4c55bb1ee2", "object_relation": "md5", "Tag": [ { "name": "94-26-106-194", "colour": "#BEA453", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373672, "uuid": "772a0beb-30ca-4bd2-8b27-87dc2e31ab1a", "comment": "Malware payload", "value": "b7ada2d712c40a1c38e634d62215bac0a06d64662fe22b098cd32f019491f294", "object_relation": "sha256", "Tag": [ { "name": "94-26-106-194", "colour": "#BEA453", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373672, "uuid": "f3adcd5f-d7a3-486c-ae54-fcaa801aca1f", "comment": "Malware payload", "value": "7221cd09042101078ca5c3b02eda7777037f90e3", "object_relation": "sha1", "Tag": [ { "name": "94-26-106-194", "colour": "#BEA453", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373672, "uuid": "5e78b1b1-4e1d-4813-8c15-dfd5943e11ed", "comment": "Malware payload", "value": "7223ebd0dc629bb25bf564d8d424774a4fcd945fe4222df7daa560a5c05016241ad25443416ad357e52221489f39d996", "object_relation": "sha3-384", "Tag": [ { "name": "94-26-106-194", "colour": "#BEA453", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373672, "uuid": "176f6dd8-bc1d-48c6-a918-c9b7e9174c25", "value": "T125A633A2C1FE8B21FCBFF5339E7DA2587463C21281948F64031B1B9704DD2BE99BA554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373672, "uuid": "f5cb0b94-f52e-4530-b475-f97b4db77b01", "value": "196608:X/YV5tmdRRAkQWHA3bXDImgyu1dlIhlC9o+d/BjMN47L8Vl:PYZmRRQfwh1dUCeixEAAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772373672, "uuid": "4cf335d0-f117-4f31-a589-62b0537adcfd", "value": 9625391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772373672, "uuid": "a51a9d01-eca9-4c8d-ae9c-4885d176740b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373672, "uuid": "7be3b672-63d0-4292-86a1-d0f3fe654a85", "value": "beben.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64498e6a-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357474, "uuid": "b0ee88c8-3324-4cb5-86cf-79d277c29a6b", "comment": "Malware payload (AsyncRAT)", "value": "e0fce719ea135132228d57f6a6eb050c", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357474, "uuid": "8e7aff35-e40c-4f2f-ae6d-f2b27e0d99db", "comment": "Malware payload (AsyncRAT)", "value": "b8b4a8c1b464ebd2c165c0d2eb79988482a5326c76a1735734a374b984a1fc7e", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357474, "uuid": "623c0198-d609-4b33-8dee-cf590860cda5", "comment": "Malware payload (AsyncRAT)", "value": "73fb4af0bf93522d51934ed2d3cd8c58faadec8b", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357474, "uuid": "772d7ff5-a068-4d48-9037-8dc678009a0f", "comment": "Malware payload (AsyncRAT)", "value": "ed22d5e751546af457b6bf17f09df840e5618eca257621d2c2acc82ce6e2d0ee386bc9f9bcb34bfe231f993164fae7f7", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357474, "uuid": "449a1fea-c932-43dd-ade2-d306a5e0d807", "value": "T1A45533830EE6DF6DD23EF7124172E72C7E121D524332AA506172D57BB85B01EA83F998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357474, "uuid": "68b4d5b2-a249-4d05-90c8-ecb99e47f536", "value": "24576:G+aW2FrVC+/257t0+knwUkEtUJmf/Gh4bGi8iLUgL4ao+IYBmKz4L+jmWP:BaWeCvttItUM2h4aFiL/LmrO14LwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357474, "uuid": "c1f85956-812b-4b59-b348-cc451eee021a", "value": 1395901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357474, "uuid": "c4182ed4-4ee4-420f-94bf-96cea657db0b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357474, "uuid": "0603fc04-ffd9-455e-bbf7-9ca061c85273", "value": "b8b4a8c1b464ebd2c165c0d2eb79988482a5326c76a1735734a374b984a1fc7e.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d91572-1568-11f1-a769-42010a9c0008", "comment": "Malware payload (pure)", "timestamp": 1772367437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367437, "uuid": "a7183046-37b8-4ef4-b12c-0d9e45db90ab", "comment": "Malware payload (pure)", "value": "e997e8ddbeee64b579fde8bfd18c281c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "pure", "colour": "#6BF859", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367437, "uuid": "8ea97025-58c3-4463-b1f3-a30ece0f15d5", "comment": "Malware payload (pure)", "value": "b8b7aecce2a4d00f209b1e4d30128ba6ef0f83bbdc05127f6f8ba97e7d6df291", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "pure", "colour": "#6BF859", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367437, "uuid": "846afa9d-289d-4ad0-b74f-3baf628a047f", "comment": "Malware payload (pure)", "value": "f44c5c2c3b5e985b3d49726db36aa5e9eb3f83fa", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "pure", "colour": "#6BF859", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367437, "uuid": "22cc6f87-0208-49f0-bbc9-fdc6d25c6458", "comment": "Malware payload (pure)", "value": "1cd1206e7e9c90ee36b35b3c758239497f46bc8b56d65069ad22d06db97c5999ae4f0a2585753bf41552992ed0d92315", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "pure", "colour": "#6BF859", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367437, "uuid": "4f935f1f-95e3-400c-b2d2-94bb863ffe76", "value": "T10DE633AA7526E473CC772A7A5996D633C749FC07A1F3512C7F2CB252923241AB4F1B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367437, "uuid": "3e7dd02c-73c6-4945-ba92-6011b48c065c", "value": "196608:mVMh8BzDH03Ke6hV6As2EbMfFqu+5F/6ieVnibzczcGcezKey2nnFOEbdjVFKF11:xiDH0Ws6gu+iiIiXczDzKeJVVkUqSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367437, "uuid": "38fb5205-8e12-4148-b979-4c2f6e77897a", "value": 14682112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367437, "uuid": "369048c5-a2df-4b2b-8fec-fd0143fb44d5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367437, "uuid": "b294f49b-5121-4e8c-a43f-a1bfc0f92406", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b936d9d-1546-11f1-a769-42010a9c0008", "comment": "Malware payload (MicroStealer)", "timestamp": 1772352789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772352789, "uuid": "74d7bf3b-f961-49fe-b88f-bdac15a07fe1", "comment": "Malware payload (MicroStealer)", "value": "54af16a88369bfe864ca6c1228613cf4", "object_relation": "md5", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772352789, "uuid": "a9f19240-5508-494a-b2ac-1b396769def6", "comment": "Malware payload (MicroStealer)", "value": "ba7d9b8cd934038441ad8bb8879a4f4715d532ef3ead83e656491f8da2284f4d", "object_relation": "sha256", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772352789, "uuid": "596eb6d2-8c72-46b3-9ac6-660d79f0811e", "comment": "Malware payload (MicroStealer)", "value": "7e914c6e779b4f83f681dcf81cfee21a0110c194", "object_relation": "sha1", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772352789, "uuid": "0db47bb0-2ebf-4441-90da-5db6453e8558", "comment": "Malware payload (MicroStealer)", "value": "abde10b24b3cd0d2d4afc5494b31c58370d5be4b14fac04c150e3a3c2f7480b8abc712a57b63255c19cc10cddbde3bd2", "object_relation": "sha3-384", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "MicroStealer", "colour": "#E85CC2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772352789, "uuid": "f9f5e4cd-f375-4c0d-8490-48e2737e04d5", "value": "T100570219D15F403ACA57D67928EF4BE6FF34829F8220571F23F439198CD2B890B6275A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772352789, "uuid": "de09b018-43a3-48b8-b846-29e8e78cc9fd", "value": "786432:LDNcvQGN5q+feL1rC8Mk4CrpPXjstm97IDEzj:LDNc4Y55eLVC8MkDtPXWu7I4zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772352789, "uuid": "b96b1e95-acfe-434a-83b1-7662bb137eec", "value": 29586231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772352789, "uuid": "cfcd503b-8e9e-4309-9f01-468d7bacb097", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772352789, "uuid": "3e1eb52c-b8f5-419f-bc1e-ea7dcf56bc40", "value": "system.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f64dac-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357483, "uuid": "64b1e77a-b656-4656-819c-af3991452047", "comment": "Malware payload (AsyncRAT)", "value": "dc66527454c664199c0959dc7ca576dc", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357483, "uuid": "c3cc7061-78c2-4bf3-a438-29011d77efdc", "comment": "Malware payload (AsyncRAT)", "value": "bcbfbd1220992bb8d327e199e25273accb4e73160397d445c06c98bb90e5a194", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357483, "uuid": "4caaecb3-7141-40e8-aae4-3953077d6a7b", "comment": "Malware payload (AsyncRAT)", "value": "6e9ef8b1d6a17611c003b2793ed41b091a8bd7f4", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357483, "uuid": "c98472b5-63da-4ba8-8e35-c64820c8fc15", "comment": "Malware payload (AsyncRAT)", "value": "cf6039e1dbea5cd2d279d8b7afdf13e4756edb3a562f38caa32a65fc0008eb209b965298d832f698d636f8713e597913", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357483, "uuid": "19f16587-f6b6-4f80-863d-3fe487fa08d9", "value": "T101F25D083F944229CAFF7BF619B265121730F5079A13E79E0CE48AAA7F77BC045447A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357483, "uuid": "5361dc58-6271-4694-a7d8-bb8643629bf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357483, "uuid": "c7969d8d-b853-43c3-9740-5cd285d04efa", "value": "768:I8/bF82C6UBiwExPHNElQFG9YBOMhikLL3:I8/p82ClBiPxfNEOFG9YBOMkK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357483, "uuid": "4e699104-036a-4688-814d-bb5f8d3a40d6", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357483, "uuid": "56481d21-e9fd-47b9-aaaa-8cf832c169d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357483, "uuid": "9929454d-c901-4c3c-8c97-ba968e00c97d", "value": "bcbfbd1220992bb8d327e199e25273accb4e73160397d445c06c98bb90e5a194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de08d8a0-15be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772404493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772404493, "uuid": "722d534c-2083-4ba7-a391-1366303cb2ee", "comment": "Malware payload", "value": "12899d3b2b9b1733d0fc9a94df9dc140", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772404493, "uuid": "5b3679a8-7f40-4514-b8fc-099ec7dffaca", "comment": "Malware payload", "value": "bdf14bf62c74fee40b70e63c124e46dd14be9ad21c1410d5eda0861a6dbade8d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772404493, "uuid": "f599964d-1f79-4105-a73a-bf2e004f1eb6", "comment": "Malware payload", "value": "e731cb549995260d82f7481fa5474a16e04645ff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772404493, "uuid": "a570eb14-2c69-446d-9299-70634916248d", "comment": "Malware payload", "value": "c082fa8baa66c78eb5945b48377c80223381e5cab955dad8d6d954a01fba89c5f2ef2d1ed2b1c59d1c29b4e17f79150f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772404493, "uuid": "afeefc6e-500d-47b1-887b-7063251e7669", "value": "T16FC57B0BAC9508FAC46E96B689B341A23B70FC090B7263C75F917A786F72BD05C79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772404493, "uuid": "a3efc7c3-64e4-4de1-8103-0dd3239b08a5", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772404493, "uuid": "30c58045-8c8e-4be8-8ecc-b1bfc3102053", "value": "49152:CCzUXzA7KQzn58WuBGEp4ATuPig/GXMbwwFuBLze1d3:CC8u3uXVwmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772404493, "uuid": "51900a6b-3611-4f1b-9949-730e72fbaff3", "value": 2498560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772404493, "uuid": "2d0279d7-c1c9-4aab-85d6-597d306c08ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772404493, "uuid": "73a92488-ac18-4f8b-8a18-f8a662c5051c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a15894-1593-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772385736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385736, "uuid": "c9e358f0-b16b-4102-b889-2c778b8ff198", "comment": "Malware payload", "value": "fe685aeb7e12d0e075034a4c26ec225f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385736, "uuid": "f7f9f6d1-b5e3-415b-8feb-7869a10688b9", "comment": "Malware payload", "value": "be3eedac2bb56db9f3a337fc6f68e6b5803ee682b335a0ceecb13f423382d5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385736, "uuid": "4aa679c8-8c2d-4733-951f-eb1c58a79e0a", "comment": "Malware payload", "value": "d4769fd6ab1ce683c3e7c546bd4cc4e11f3ef87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385736, "uuid": "b10e8a67-e9b0-484e-84e4-d3e0d294d11a", "comment": "Malware payload", "value": "d626b079697df3067726de5c253409903c5ccc11aaa6308610a3f6a71677207951fb3fec3668659790cb5474cff34740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385736, "uuid": "7246a12a-968c-4f80-8c63-d9ac56bd1f79", "value": "T110E6186B665D857BC11DC2FAC0B28BCCD5F370BD1772C6E792A003E81E469D05EBA624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385736, "uuid": "f55dc007-927b-4341-8628-ab3a9872aeb6", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385736, "uuid": "480d0d0f-c0f4-4e30-bf30-5d1986ba09a3", "value": "98304:DfbvYfLRXJbWCnIljJd/8+p0jT0/CoRdQI:DfbvMX+oceT06o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385736, "uuid": "ee03bc2e-a169-4e2c-9022-17dba37bec8b", "value": 14096384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385736, "uuid": "f7a72caa-bb3a-4079-b147-ade1670a4b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385736, "uuid": "ca7fd00c-fd3d-41ae-b43b-2f87b54e67e8", "value": "SecuriteInfo.com.Win64.Evo-gen.37694275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a65a6b-1570-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772370734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370734, "uuid": "167121e2-0c0f-44ec-8885-62f69cd97950", "comment": "Malware payload (Amadey)", "value": "906a7f07823e9a1c7a990ce0b94dac5f", "object_relation": "md5", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "91-98-149-203", "colour": "#DFAD4A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cyrex-cc", "colour": "#CB1226", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370734, "uuid": "02de320c-86a0-4467-ad49-ac2593df716a", "comment": "Malware payload (Amadey)", "value": "be7927207cd22502eca7cfd6c22a950190b6deae91784a26a085afec9d902162", "object_relation": "sha256", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "91-98-149-203", "colour": "#DFAD4A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cyrex-cc", "colour": "#CB1226", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370734, "uuid": "2b4c74dd-6460-4f14-af21-b6299e75e35f", "comment": "Malware payload (Amadey)", "value": "de24ab8b1b003d327156bce5180e31388e5e8f3a", "object_relation": "sha1", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "91-98-149-203", "colour": "#DFAD4A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cyrex-cc", "colour": "#CB1226", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370734, "uuid": "487b2fe4-5e6b-415d-b9cc-48ac594a0080", "comment": "Malware payload (Amadey)", "value": "44196333ca81b2777d282ca1a6287fae426527a83879a256e2d91704112ecc3d4b1099ecff2202c5b41d79ee850e0517", "object_relation": "sha3-384", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "91-98-149-203", "colour": "#DFAD4A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cyrex-cc", "colour": "#CB1226", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370734, "uuid": "9a1c2645-dbfa-4bbc-a666-c64408284ff6", "value": "T1BC775B0772F30CE9F02B827041265331F2E3AC657FA099965A95E6464E397D28FEEF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370734, "uuid": "e3a90e3c-ee13-4dad-a29a-9fe0acc3e655", "value": "3ebc6615ee6e83e349ea34fde3fe4d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370734, "uuid": "f6f6bcd9-e266-43be-a9ab-2b852fd09e3a", "value": "196608:uJSMCI4mGY40P3lzFIIyoh1Cw6wkzz6W5AtsQattHS:xMCI4n0P3lVhjkz5ZVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370734, "uuid": "0e260f6d-b514-4776-8e89-0372555b52cf", "value": 32764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370734, "uuid": "6cf6ff48-328d-4492-bd39-1b3f77c0ad53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370734, "uuid": "31076ef9-8983-4acb-83b6-bcaf2075378a", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c1eec9-1552-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357857, "uuid": "defddb1f-1f5c-4a3d-9950-94f1170755f9", "comment": "Malware payload (AsyncRAT)", "value": "db0156d56474b360016cb3331e59adf2", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357857, "uuid": "da07dc2b-981f-4fdc-8a8c-85a755ded9d5", "comment": "Malware payload (AsyncRAT)", "value": "bebb4bed2e81e35672a57429b17ed84872949b5833479937ec0ca97a30b1609d", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357857, "uuid": "f28a2998-fe6c-44a4-b56a-0b9f108c27f2", "comment": "Malware payload (AsyncRAT)", "value": "9436817acddbf612d24d6ba81992f034fe811d66", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357857, "uuid": "a6adca75-771a-468a-a2b4-d0742765cb49", "comment": "Malware payload (AsyncRAT)", "value": "6c1ac23b9e3fc9cb75ccd93b7a11dfd142e211b4025f43c0c71d82524444c2f1ed55d33e618e8ef66a1510fee64dacd6", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357857, "uuid": "a6dbfd3c-57e9-40dd-a12e-07f948fba231", "value": "T19AE56B11ABA50EB0D53AD6B4C9175332C771B9A59370838B12AADA5D2F337604B3FB70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357857, "uuid": "2cd2d9ec-10b1-4a59-8b84-1e29fd2157eb", "value": "250eb22383f63544859c02259e2d57bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357857, "uuid": "d23e3708-27e1-4066-8663-84f19ecf38de", "value": "49152:JYtY5r4Mt25wwj3bOzycColueuMmzyZMFMSgaX822nXrqMM87C12:hrIiwj3bwlZMFqaXert", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357857, "uuid": "1e561d6a-d5ff-4efd-aeeb-bcc5fba27d0d", "value": 3297792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357857, "uuid": "9a4f2a0e-5d2c-490f-aa65-2b8700bb804c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357857, "uuid": "baeaa8d5-c3f8-4b2b-9cb0-70205d12cd9a", "value": "MSVCP140_4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a010bc6-1556-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772359550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359550, "uuid": "728244dd-1171-42a9-962b-e180abccbeda", "comment": "Malware payload", "value": "709d70239f1e9441e8e21fcacfdc5d08", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359550, "uuid": "5e6d7ee5-d036-4fb8-bb77-06e8d8e2cda5", "comment": "Malware payload", "value": "c07e0f01e39ae74667d3014904706b50effd1f3cb75e8130eb57729d38589ad5", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359550, "uuid": "dc16b477-52b5-4aa5-93a6-202e87e04cfd", "comment": "Malware payload", "value": "f30ef4afe1c0c3f8694d820bf469335d0f2f390d", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359550, "uuid": "16533981-f9da-48d7-b146-a861d2f5d329", "comment": "Malware payload", "value": "905dfc4e76e3ff651fc438b57856dee90ede71ed572756936dc627fe2a1ff3ab1d8695e7e96d57c93780d769433c4e33", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359550, "uuid": "7a527d7f-09a6-4d59-bf79-024fccda0169", "value": "T160F49DC0CE11D4ABD7B01E37582AF763E75A915AEF3792381C9DE7A0E522151B60883F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359550, "uuid": "6ed0e76b-4429-4416-8ac2-80ca9fc575a5", "value": "12288:+3P6aPT3PhZIBW1kwlwD5D0uvkO4ccskJ1RdIa5UgTzHfGgFvaadXtI9r7dQczNx:baLABW3l9bDU2/GRYWX3z4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772359550, "uuid": "fe4815c4-480e-4866-ba6e-41ecd0401e4f", "value": 778120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772359550, "uuid": "d6d20850-8a81-4b73-81e7-e1466342e779", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359550, "uuid": "7fc405d1-c6d0-411a-8e3d-7970343009a2", "value": "c07e0f01e39ae74667d3014904706b50effd1f3cb75e8130eb57729d38589ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7d1c48-1514-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772331211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772331211, "uuid": "28c2aab5-0f0d-4899-8c24-c6d7533330f4", "comment": "Malware payload (Mirai)", "value": "b73157b9e3e42c2ba62bdaf267061ccc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772331211, "uuid": "1f73624b-09d7-4e3c-a2a8-cd0ea508704c", "comment": "Malware payload (Mirai)", "value": "c42ef522347cda9e7c035dc850a14d1b734b92ada54d66a4add6eeffff94f4b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772331211, "uuid": "8e872afd-0e59-46f2-aef9-9f25fefcbfdd", "comment": "Malware payload (Mirai)", "value": "d4fa708acd73733a7bd2af77af7d2320526b5178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772331211, "uuid": "fe7e1ff4-226c-46cc-b2d0-1b91d17f73d1", "comment": "Malware payload (Mirai)", "value": "0f5524293d2e8b0d0efaf1c7954bbc79bdb224277e3bf6ce32286a77e5964618f9eaa335c855276f76038da026dcc5ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772331211, "uuid": "a0493a6f-afe4-40d0-a9be-2ec246ba1e3e", "value": "T166D35C0677180E17D5A34AB0263F1BE087FED4D121F4BA89291F9B6A4672D3B1582FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772331211, "uuid": "bb2dbf1d-279f-4027-8e62-8e3b487e65cd", "value": "3072:i1kzeSFZhMHJqA+Kr5UbeU73HegqM89VkJA:7PFY+cqbeU73+gqM8XkJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772331211, "uuid": "8a6636af-07b3-4e4c-a9e3-ad829b20e29d", "value": 134320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772331211, "uuid": "65605ccc-6669-49cc-8da7-8ab3b3cd3e09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772331211, "uuid": "df7999cb-80f6-4079-8cd4-33132d874c97", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd682777-15a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772394668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394668, "uuid": "350e7d59-b670-47e0-b611-dcd06ca0ef54", "comment": "Malware payload (Mirai)", "value": "1705c55d21cd0239ff228447b0d266c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394668, "uuid": "5ede0412-a766-4fb6-b8ca-6b4d17a6f3ef", "comment": "Malware payload (Mirai)", "value": "c6c1439ed445a44d10518585ab767bf8946ac4c0803e2b16342f41a857ef0e0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394668, "uuid": "fadf2ff1-a2a8-4db1-b4a9-e7311127eba5", "comment": "Malware payload (Mirai)", "value": "f2697d5cae709447ce7863c3d926357341d2e25c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394668, "uuid": "126094f2-9281-4804-b012-f7e84d2db2dc", "comment": "Malware payload (Mirai)", "value": "bf0d78e19de22564ab49ac3dcfeed40716cdd2693bc9165a8181aec468c06821a95cef7c26e28fa0ef14485ca0d9b4d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394668, "uuid": "68c2b064-68a3-46ff-8804-bce8cfbbf60f", "value": "T1F4F31955FC518B16C6D262BBFF4E428D772B17A8D2EE31039D266F20378B95B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394668, "uuid": "adf886f9-472a-4b48-ac4f-1ac948a63880", "value": "3072:YlAx30dAvAXa4rDzRST6yHnuaP4MV1jI4OT8hEvgawNcaGKfnSr:kAxkdAvca4rDNST3DQKjI4i8h4gXN1Gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772394668, "uuid": "3d2ba98e-c97e-4296-a33f-5bcd10e90c92", "value": 158456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772394668, "uuid": "cf363cf6-9b5d-4237-92c1-41ec11b79f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394668, "uuid": "6b81d96f-f04e-48b6-b353-e145a44b0e9a", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5562ac-150a-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772326971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772326971, "uuid": "08be69ab-9bb0-40bb-b5a2-55cc582fadd0", "comment": "Malware payload (njrat)", "value": "54a357601a27f1d140a46df93f8ff3cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772326971, "uuid": "dcc77e55-9835-4f1f-b659-780ca6ce44e1", "comment": "Malware payload (njrat)", "value": "c706f26e9415008e1a59ae096932524bf0235a8fd003d476c2fb6a1684fa3070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772326971, "uuid": "5fb9f330-e36c-4f71-82db-0edfa083da2e", "comment": "Malware payload (njrat)", "value": "f74c50528196555ded31c8974d3525e481756780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772326971, "uuid": "398c20ba-a0dd-4733-9a9b-c1462155edc7", "comment": "Malware payload (njrat)", "value": "da5c18e0c49d0dcc3f1b642743f3f116b6bf25a0bb9578be7fb3bdce04ac803a40af5d7d14b415faee6d3d3943f3d83c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772326971, "uuid": "b5678756-fd5c-406f-bd6c-4e0961b9223c", "value": "T15F25C09077F4850BE1FF2B79A4B249094BB7B9525A36DB4F0D88D0AD1EB37408E113A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772326971, "uuid": "dde1a7f6-e4a8-45df-a4c6-0695b51a94b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772326971, "uuid": "c671d7fc-d758-4922-bcdd-e8e3aef3ff2d", "value": "24576:HF/pnxJzck+uGW/yFoBkkAQKWL2FpIP6fgx4:HF/pnTYjqqanTCQPuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772326971, "uuid": "e4829498-c3d1-43a9-abb1-eb7e216eb779", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772326971, "uuid": "651afde3-74c8-41d5-b606-6cfdd3bf6ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772326971, "uuid": "53634982-051d-45fe-aa2c-04a05e18b78e", "value": "Not a rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6303a8-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772396763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396763, "uuid": "ee39c4ba-21c8-4e0c-b40d-7e8db395833c", "comment": "Malware payload", "value": "b8aae9807ef00941e9f22ecb86efe7af", "object_relation": "md5", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396763, "uuid": "937f29f7-e206-445d-b07b-1152c9fedcb3", "comment": "Malware payload", "value": "c8770d59ad8eb9f6b4f19a780f9d8757c6dc0706712b04f0c5d896b9f51dc057", "object_relation": "sha256", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396763, "uuid": "a3ab0655-81ae-4ae0-b65b-a7d8d3b4d62e", "comment": "Malware payload", "value": "f3496d96f3c8d9049b27aca5c461f107aca7591f", "object_relation": "sha1", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396763, "uuid": "c96b639b-5166-419f-8038-ec0454191a4a", "comment": "Malware payload", "value": "b3cb866016ef6067dfbe9e692bf6e3fb6947d6de36e59a222507740b6d26b7b442b2bc92d7762bb970ca1a790abd36ee", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396763, "uuid": "0a350dd1-3f86-4b92-bc27-9d4d9077a8f5", "value": "T1CA4633379FACC0B98AA1A84134A4ECC79614A4D93C7B745DDCC8F8EA575020D76E3B8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396763, "uuid": "e09740a8-8240-4924-8321-fbaca7ee6a8d", "value": "98304:wVtFOmLAPO8YYkKpJqep9VVJvVLEOp2tPv0uifhW4+ZkODcBls3rrdnXXK+hZ+s:gasAPxkKXp9J6g0bifhW7pIBlstnXXKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396763, "uuid": "3e2d35cb-b06d-4365-b59b-53f0070789e0", "value": 5676373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396763, "uuid": "4ea9f528-887e-41bb-9df6-844b82f58015", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396763, "uuid": "f9e26b02-8e34-4989-975f-ad9b07e7bec1", "value": "V\u043el\u0435cit\u0443 UI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e217659c-1571-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772371429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371429, "uuid": "aa6f9624-1814-4873-a480-45e75cc0ee1f", "comment": "Malware payload (njrat)", "value": "58a61d4d2c94f1a69accc337c6a5fdc3", "object_relation": "md5", "Tag": [ { "name": "103-75-13-174", "colour": "#85F900", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371429, "uuid": "3529d9e9-9c31-478b-a332-f97be359de9f", "comment": "Malware payload (njrat)", "value": "c8889f7c39ee60be6f8b6b8c120987d3997e8d797d3218a1132582fe9c23a454", "object_relation": "sha256", "Tag": [ { "name": "103-75-13-174", "colour": "#85F900", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371429, "uuid": "4764263a-4ef5-4219-a247-69f94ea9d77e", "comment": "Malware payload (njrat)", "value": "46aa1890e772ed47a1a171ee179e0c773f5f637d", "object_relation": "sha1", "Tag": [ { "name": "103-75-13-174", "colour": "#85F900", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772371429, "uuid": "e5450402-59e9-45be-975c-23722d0cbfa1", "comment": "Malware payload (njrat)", "value": "a1d775f531eb0c5d122be0efa9a8ab8bbe7eae125beeb7db515eb93ca79adfe829825cfd47ff30671964920e5eb64d02", "object_relation": "sha3-384", "Tag": [ { "name": "103-75-13-174", "colour": "#85F900", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371429, "uuid": "ab28a41c-f75a-4b04-924f-c0cb7d3e5b80", "value": "T18BF73321B2773998D61FA3BFE0B85FC884306DE1B317D96B23787BB146B164661B1843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371429, "uuid": "8b77658b-f831-4db8-bda9-4ad5aab08e17", "value": "1572864:ewUhgbdA09z/3vOISo+IAAiCQW5CJplxIIKV92xxxRe3B:eN0A09D+o+IAApQuaK3+xRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772371429, "uuid": "504089ef-e0d8-4317-84e5-ee6edeb755bd", "value": 75324928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772371429, "uuid": "6a525805-ffbc-43fa-ac29-6ef810ecf2f3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772371429, "uuid": "6b41c581-9985-4361-ada7-62588beeabfd", "value": "Team-tup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c32ec5-1570-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772370957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370957, "uuid": "909a729f-de51-49c1-b660-2f06f2444c88", "comment": "Malware payload (Amadey)", "value": "2f985652fcf9580eae676a8e4138ccf8", "object_relation": "md5", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370957, "uuid": "4a8c5427-0591-4e78-9784-65df949a5aa2", "comment": "Malware payload (Amadey)", "value": "c8b9ad003f1b34a8c2c655b983fe17c749dba604e220e7f200c7866e49c05cdf", "object_relation": "sha256", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370957, "uuid": "20bcc6e7-4219-4fe5-a6a8-438a25599142", "comment": "Malware payload (Amadey)", "value": "f780f0045ceb4b9bed67a9dce4641f45a71c20ac", "object_relation": "sha1", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370957, "uuid": "a123f39a-60ed-439e-a2f6-88408f23b26b", "comment": "Malware payload (Amadey)", "value": "6cbb4c334d6c3bc8265c8caee9e883abcfe21655647b97e9b5205589799b77a26c88eb48228af3cc418d836ecaf2dfed", "object_relation": "sha3-384", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370957, "uuid": "b470591a-1eb4-4436-b03f-b76e09d2205f", "value": "T1E83633E14941360656BC4D727622C0EF26B0CED3692CED82BE254CB2EDA91FC94EDB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370957, "uuid": "1504a3d5-9f65-46b7-9812-22bbe1778e82", "value": "98304:RanLOJOjrEwmouD+Zgyvu57LwtSYlelPJaTLBxBHwGuQx3ooZ0hagoltWOqrET9u:EnLnkwtu4gyW4wVJ6LBx4Q2oZ0s/qE5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370957, "uuid": "caec84ed-9a3d-41e6-848f-ad99449ba8cd", "value": 5342406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370957, "uuid": "d6d511b6-485e-4641-977a-6222f582c16c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370957, "uuid": "3866351d-2e48-4469-8c7a-1d90e41954c8", "value": "Visual Studio.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c87a42-1519-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772333374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772333374, "uuid": "0fc5c4bc-aa18-4d72-b81e-8b0b3d342d8c", "comment": "Malware payload (Mirai)", "value": "6ee19cf8ffbdc2089af5e09705bf0cff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772333374, "uuid": "238966f4-607f-470f-9b2a-40e73cd2977f", "comment": "Malware payload (Mirai)", "value": "c9338c4441fcff1e53ccf7cb47a00dd1efa1e3c14aa1fa03ab8eae200fb15a95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772333374, "uuid": "4c7de2c8-9de3-4b5e-b9a8-c48aa8fe9727", "comment": "Malware payload (Mirai)", "value": "f5c28d9380e203e3b50198f2116d8a09d52b2643", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772333374, "uuid": "78f4dd45-1364-415f-b938-25c3c23eaf73", "comment": "Malware payload (Mirai)", "value": "6cf874d8137546d39a0520196eafcbc02b80b2275203ed133b8428fbb8fb7dca2438db1c1ff4c3f69efca2e9c24385a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772333374, "uuid": "ad60d87d-2f15-4607-8306-603f10f96069", "value": "T1C6037D7749342D98D02A95B0B0248A71472BF99587476FBF1666C37D4443ECDFE8A3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772333374, "uuid": "05818930-0651-4a42-8bba-5698cefbd908", "value": "768:wnT71QHZSmD3jX0/Fy3K2vuoa4ou5uMC3ykZtfv1jaC1IH:sZQsy3oaK2vuzXW43t12C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772333374, "uuid": "a28d6013-0993-479f-b8c0-a9c34049598a", "value": 38180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772333374, "uuid": "39769bca-1777-46b7-82f3-a9c27378c09d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772333374, "uuid": "3701baa2-94f8-4883-b7e0-4e3a9f0beaad", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75b59e2-156e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772370096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370096, "uuid": "fb476fe3-8b76-4337-8dde-99e689a1fed7", "comment": "Malware payload (Vidar)", "value": "4cc07e67cfb1827ef06567c4b1b768f4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370096, "uuid": "9516aba7-959c-415d-987d-885160b6d164", "comment": "Malware payload (Vidar)", "value": "cbad1107eb930b405ab74b452ba82a971caf5b2f503f01859a7913e5e921f245", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370096, "uuid": "e3ecec43-012a-4064-826c-0775467e1dd2", "comment": "Malware payload (Vidar)", "value": "1ee141234866e789d5ce788be601e1ac50e5a7e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370096, "uuid": "64914d1c-ffc3-4e0a-9429-a84f432f3ba9", "comment": "Malware payload (Vidar)", "value": "0beb266333039e39bd553a025bfef42e970d000c18d390afcfcb088f7f0331dd85f5cd38e151ddbedc01a643d3be75e9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370096, "uuid": "d87b07a3-8aa5-4eb9-8d63-cacc9d17f7da", "value": "T12BD56B17BEA05CA5D42ED375DCBA12867735BC1C073323D31A2A7A342EF26D1587AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370096, "uuid": "bb710fe2-26fb-408a-9813-b998f6c50ba7", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370096, "uuid": "3e9a1ffb-b792-489e-ba05-054c37f8f47b", "value": "49152:zhn+4x21m7ot45ABss5zcL0K/Iptnt4/5:zhnAcT65zcLFwpn4/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370096, "uuid": "9b2278b1-7561-4a99-9da4-9e10325060cc", "value": 2790346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370096, "uuid": "e00d69ae-4455-4ebc-bcb4-fa053c7ddf53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370096, "uuid": "17ed16c0-03fe-4e9f-8eba-88a9aa76fc13", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe46a81b-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396816, "uuid": "ce94e9c0-76ab-4c98-8a69-fc3aaad6ae67", "comment": "Malware payload (Mirai)", "value": "194082cae4d0fc9de1186c9091f5e1e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396816, "uuid": "ab19d3a9-a68e-4d1b-80e9-0b975d967fb4", "comment": "Malware payload (Mirai)", "value": "cc6f011b9935ba4fa9be8faf11613a022df3f2fcec058371ceb86e4478e26b32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396816, "uuid": "648d2ef3-87fe-4bef-be10-b3ae0f493e6d", "comment": "Malware payload (Mirai)", "value": "03e62e6c92304c58ba343561a67f5072e42d112b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396816, "uuid": "7de9e7e3-6a4b-4aec-bc5f-8564e29ceb35", "comment": "Malware payload (Mirai)", "value": "5a5bdd9ecf3dc889a57c511f4629fbac51c3fa0a15fad81488c0d3f101d7b1691dfd07284d2d149a4f622705af103278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396816, "uuid": "be2752d2-0407-4789-b6a8-b6afe05029e4", "value": "T197F30956F881CB11D5C111BAFE1E514E37232B78E2DE7212BD246F3C7B8A86B0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396816, "uuid": "72e29639-0f1c-44d0-985f-1c131ba27cfc", "value": "3072:t7pAQmUvPHtLXjuPGB6aBCqvqy7AyE5W55yCBgIU3x9896:zAQmUVLX6PGcaAIH5E5Wu4gt3xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396816, "uuid": "504ec3c1-2f1d-401f-9b67-5ad3ac3ab5ed", "value": 169724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396816, "uuid": "0eda3fde-fce0-474a-a89d-4856fe931925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396816, "uuid": "370c7514-a8c8-476d-98ae-4b77d6eb95e7", "value": "csk_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fb1841-1516-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772332316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332316, "uuid": "63fb8fe7-1d16-4737-ba20-59fcc687fe12", "comment": "Malware payload (Mirai)", "value": "334598f74615e713c4e16cb261b107c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332316, "uuid": "0ac96cac-9769-46d9-b251-b69ffff5d232", "comment": "Malware payload (Mirai)", "value": "cd1fefc661c94321513075e0ca9655b9aeab54388932dbec4b5df0b2d8e43438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332316, "uuid": "efcc28b3-5c41-4f17-b9c6-d9571fe912a4", "comment": "Malware payload (Mirai)", "value": "d01fd32a0dd139bfdaed24ef6d6db3de3265463a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332316, "uuid": "cee29849-d06a-4e15-864c-609ed45ae5fe", "comment": "Malware payload (Mirai)", "value": "f377e8c467d0d7f46ac0ea3492e1d3502f10468918bfd4a6a7ed623616fb4ed1102481ebecac6cd866e2908dfb8b393f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332316, "uuid": "fc2bd8e0-a12a-4857-b33b-7799000d07a2", "value": "T1BD63175AF980AB02D4D625BAFE4E118D73531B2CE3FE7201DE245B2523CEA6B0F76411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332316, "uuid": "103f4bae-25c4-461a-a19f-26be2a99e931", "value": "1536:0onumiDNQJatWWoH8TTCloicDImf6tYa00:yDNQJatWWoHwDImfKs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772332316, "uuid": "68afdc09-68ee-4747-821f-f4c6a3d13d9c", "value": 69204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772332316, "uuid": "153292b5-58eb-46bd-89e6-adc08bcdb4a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332316, "uuid": "982ec61a-e4dc-4cc0-942f-6e0744333167", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363ef248-1556-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772359544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359544, "uuid": "cae5d78a-6423-4328-bee4-9642027352ab", "comment": "Malware payload", "value": "ad556f4eb48e7dba6da14444dcce3170", "object_relation": "md5", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359544, "uuid": "7af94844-393c-47d1-a3ad-d9930815dea8", "comment": "Malware payload", "value": "cf2e3f46b26bae3d11ab6c2957009bc1295b81463dd67989075592e81149c8ec", "object_relation": "sha256", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359544, "uuid": "520dd998-edec-4aff-9dad-1612e2c70822", "comment": "Malware payload", "value": "3407884ad2990eeeb7bf1084eb30cfd86568c4f0", "object_relation": "sha1", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772359544, "uuid": "304bc6ca-e6c1-404c-a5a4-22b673e6bfbc", "comment": "Malware payload", "value": "e11269e457916d5c4d92b01cff3e69688b91bdc8b25a1d9f533bafd35921be53962eeddcbc4e55475451e08329da0b26", "object_relation": "sha3-384", "Tag": [ { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359544, "uuid": "4602324f-136b-475d-beb8-ecad9cb6b3ef", "value": "T15DF47C62B841D033E1E10072D7BD9B725D2DA534072AA0D7E7D41E686A740D3BF3AB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359544, "uuid": "8f197740-2ae7-4bbd-96a2-030d319ed5b3", "value": "a4fb2de7d2bf27dff63aaafd62a891e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359544, "uuid": "13be1d12-0093-496d-abd3-723c3d889815", "value": "12288:jCTTNj5F2Md0cGfh5xh/mYlQs6zSB6oB0fsTA3x3VeJOE7Lv1x1CYMS8VFVxh:jCTTPF2Md2OYus6zS+fs8M1WYMSiVxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772359544, "uuid": "5fbb6f05-be68-40aa-9d44-560023901631", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772359544, "uuid": "6aff4118-9cac-4589-82d2-d9984b996c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772359544, "uuid": "405f585e-0596-404a-bee5-71584bdb90ce", "value": "cf2e3f46b26bae3d11ab6c2957009bc1295b81463dd67989075592e81149c8ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a766fee6-1594-11f1-a769-42010a9c0008", "comment": "Malware payload (Redosdru)", "timestamp": 1772386363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386363, "uuid": "c6eeec1c-9b9d-4d87-8ea6-949096d88afb", "comment": "Malware payload (Redosdru)", "value": "3aede9c0e4e5e3021b5548b4ab9fc091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386363, "uuid": "b3a7c85a-6373-4c07-962e-75a96a1a7eb0", "comment": "Malware payload (Redosdru)", "value": "cf50fc54c8edce69fe5efd7e0cc14367b951b4661e653ce47f1280220f356217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386363, "uuid": "54334173-7f80-4af5-8967-656fb7c1c1e6", "comment": "Malware payload (Redosdru)", "value": "78c31c09edeb1f0725041617453117f34fc8279b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386363, "uuid": "9550dbf9-c9c2-45f9-b9c0-cbc5bf30fe78", "comment": "Malware payload (Redosdru)", "value": "0932a97a8875fd8ee36d2137afa8c706ee876e2d59b0c4f4f8221856a39afdee156480caa6199dbbd7e8bded64995df2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386363, "uuid": "af013049-cba4-4335-887f-97b8f6f9f80c", "value": "T1491533227767E872C85E927E55DEA31A97B824CC490EFB54420F2029DD631BC3CF864B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386363, "uuid": "26a9f4ef-b332-43e1-b436-9ce53b96dcc2", "value": "32eec93df9d58252f6535aca9215cc5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386363, "uuid": "40597c0a-1090-4ed4-97ef-690e865b6196", "value": "24576:eqxifJT61Zx3cBkiexWBlcZje022WK1GHPPkJ8pE:eqxsRsZxsXodj1m21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772386363, "uuid": "8144e3f6-d2d8-4ace-86e7-0fd68208339a", "value": 933982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772386363, "uuid": "0d98fbb5-5b1d-4a35-82ed-7cc04735c7fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386363, "uuid": "55ed7e32-27fc-4d6a-bd87-e4ab031a361f", "value": "SB360-1010-2.vmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e194c6df-15a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772393762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393762, "uuid": "998ae4d6-d72d-4285-8a99-8d785c7f25e2", "comment": "Malware payload (Mirai)", "value": "61204d512be0fd7552dc063d5e5fd3a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393762, "uuid": "a8d11641-fd57-44b8-8248-cb1306476220", "comment": "Malware payload (Mirai)", "value": "d0d56f14243924138434f8368c3cb0bf273124fc02e1aef83c2d260471aae74f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393762, "uuid": "1dc18309-87ab-453d-8635-aed0a182b98b", "comment": "Malware payload (Mirai)", "value": "6e89f256d5a9c5ea9e68fc7f69c2ec9edb146c06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393762, "uuid": "c8a67d07-d43d-490a-9aa0-974834fe00f1", "comment": "Malware payload (Mirai)", "value": "930a72babf1072d9c6275626b2788d602018d5aeaf0ca5be3f9a23d381e8fbf5e5b5f4857f132ac539faa16971db6eac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393762, "uuid": "71858a0f-dd78-445e-9317-0ceb00ad5309", "value": "T102158C5BE2A370FCC157C03447EBDA73AA32B47512216EBF51C8DA312E16EA0135DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393762, "uuid": "0007cf57-0703-49e6-affc-f1e391d6924e", "value": "24576:6/qO+oym4kRQ+fVQS4UTVrSG/JdBKUBgK2r:iqFoym4kHfjkGHBKUB12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772393762, "uuid": "2e9b56e7-3ed0-4e6f-a414-07a24ce288fc", "value": 910176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772393762, "uuid": "5eaa1ba0-9afe-480f-86d1-e49b938eef8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393762, "uuid": "d7c11894-979f-4cca-98aa-3700ccf1d336", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78745856-154e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356219, "uuid": "ebdcfaaa-ecaf-429b-beb3-55a23fb89bf2", "comment": "Malware payload", "value": "adabe8ec9ff449cc378088c8bca05ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356219, "uuid": "15475439-947c-4368-abeb-8aea12462c49", "comment": "Malware payload", "value": "d10de11445b27b895f75e2d5214cb20a0838fdda58a3b698fa2a43052d3bb465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356219, "uuid": "072aaedb-7f0c-4f4c-ac0c-6a46eb7f5e8f", "comment": "Malware payload", "value": "b6e9088912a4482aaab78b07e2c31fdfa57e31b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356219, "uuid": "042ccff3-5032-4861-b008-d9d63cf8409e", "comment": "Malware payload", "value": "5b50054c6d159ed53a644420bb1daf0c36da53d5d606beae80d866be19b33597bbec3f20b0551efdebcdde360c0a1d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356219, "uuid": "e790ece3-dd04-48e0-a829-b17118753a9f", "value": "T1E208D01663A116AAD97BD1388AAB6503EB73B4071330C7DF329C43712F63AE45D7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356219, "uuid": "a7d6442b-f618-476b-a738-a4a72ef7359a", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356219, "uuid": "64313831-d0ca-4fd5-878a-b943894b7301", "value": "786432:a5EosxTUU8XOkBKgP5ebURVLeWV1CVu5woz3fSJpZBRWYF3eKMSl/3UAe:a6oslbkJQURVLeK1C4PyxOupe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356219, "uuid": "d8afea6d-0b0c-4775-9a55-81f988479c2f", "value": 80864809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356219, "uuid": "16ae4e9c-8847-4851-bb5b-6780f6f976f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356219, "uuid": "ce278daa-f1c4-477f-af04-b01e14e2be90", "value": "d10de11445b27b895f75e2d5214cb20a0838fdda58a3b698fa2a43052d3bb465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbdac32-15af-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772397916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397916, "uuid": "adf84cfd-0bfb-4629-8302-ec73954f5399", "comment": "Malware payload (Mirai)", "value": "5e219cb507b4f9a0a99778adb6ed0e07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397916, "uuid": "813a1f4d-524d-4c55-a821-d0383ac0c764", "comment": "Malware payload (Mirai)", "value": "d1d40595e0fbfa95271ee985f085ac524ce8fd23c22fc70a2abcd12df26155f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397916, "uuid": "8761ac9b-0394-489b-a4d2-73fee47700ed", "comment": "Malware payload (Mirai)", "value": "ea4f6240e53b3a909baf13696738d494fa7323fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772397916, "uuid": "06d6007a-767a-42e3-a916-52adca88fefd", "comment": "Malware payload (Mirai)", "value": "89a9de7dfb601d4cda7db88bc4702922d7dc3786d8b3ad1a52e97f6e1590482cfb5ab0de75cbb1016a7a278025765450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397916, "uuid": "7de70f8d-77e8-49e5-97b5-87aff1bc3eeb", "value": "T113F32A05B30D0947E2672EF43B3B27D1C3DFDA9121E4EA44291FAE4A91B2D325589DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397916, "uuid": "7a10ac6b-3ea0-428c-a547-3b7a38ccfd8d", "value": "1536:OJMsKax3DE5HtZZ2QvIx9v9llac5dVAEeNqIK70uNWLEGt6yF3HWhnTU4WeZvA+j:OeZaxTWYQgxh9iGnxe6yFmTxW+YvK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772397916, "uuid": "fae7fb33-c572-44d2-9e00-632d3e68dbc1", "value": 158636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772397916, "uuid": "be33711a-4f5c-4aa0-a24a-161c085cff9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772397916, "uuid": "400fe4a7-9374-4864-8c6b-37fdd4ec99cd", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df956ddb-154f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356822, "uuid": "56d95744-7dd9-4ea6-a6e4-028484b5ce33", "comment": "Malware payload", "value": "2d1ad7809f97c8eac4ffd1874c467eae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356822, "uuid": "122e7729-2065-4239-8b0d-22bbeea6429e", "comment": "Malware payload", "value": "d37c936e77e3b9185190ce906a551416baa4273e2aafced63a900b3438ef5c06", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356822, "uuid": "31781434-6da1-481d-9f52-095bfdc3efcf", "comment": "Malware payload", "value": "e2ea258218a37d154a6ad58377792f69c94316c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356822, "uuid": "f31c673d-ceda-400c-90b4-ec00bba28890", "comment": "Malware payload", "value": "2cb553863d0810f0c598cacbee92a3bc4d35e83ad4e63994f2d412cddb65668c15707c269197e17f214be1e1d27aca09", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356822, "uuid": "3f09aa26-1ef9-4b38-b360-b0fdb0b268ca", "value": "T1B8F0E14014C0BC7423F81CA89185460ED0B63BB196DB3F1877D267F18B670407109AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356822, "uuid": "565b1870-f52e-432c-b64f-505467166e24", "value": "12:MquhRnFxvhsHBTedyWSpWnqxr/ABXWBDZ9zlKpNYHj6X:MfnnDhkBedyWiWIr/smBDZhPD6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356822, "uuid": "891b8daa-9a7e-4e66-b075-6006a1fc4947", "value": 554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356822, "uuid": "9dd4676a-360f-42a1-b5cd-40da1a3040a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356822, "uuid": "5a5e273a-95b8-4a7c-b718-80ee11febbc0", "value": "m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753edfcb-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357502, "uuid": "ca36b523-9b01-4754-910f-a66c65628d86", "comment": "Malware payload (AsyncRAT)", "value": "2c2937b0d151721d07ced99ba79436de", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357502, "uuid": "2ec03c5f-f6b8-4bb2-89c9-16e8f206a5f3", "comment": "Malware payload (AsyncRAT)", "value": "d3c419262ca2d01fadb222d46078de258cbd7c33d7f090e74c27c12fccaff6ce", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357502, "uuid": "bfb315bc-7f5c-4b42-90f7-3428e1cde795", "comment": "Malware payload (AsyncRAT)", "value": "6f32b9ed4418ff759b154524948968e69bf20038", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357502, "uuid": "80498e1f-b1fd-488c-9a3e-e84a80a77f6c", "comment": "Malware payload (AsyncRAT)", "value": "61d4dfb99e947e203b7114e5aa7724aeadd5bcbcd4bcb7ec15b3f76a87a00a24a1d7f2125c2aacf724fa76ba58537aad", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357502, "uuid": "6ff9837e-eace-4a4e-9d66-3895c4d7bd8e", "value": "T175568C14A3E901B4E577EB78C6258333D6B1BC959735810F0669FA4A1F73A608F2FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357502, "uuid": "5911b4d2-5f02-4218-88b5-f40694da0788", "value": "22e78a00070f9fd81c1508aa25033259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357502, "uuid": "ebafc93b-a67c-4183-94eb-32c7f68e97a1", "value": "49152:pfSka7VuYZ1pL0XIrVHVuFrwNth4TQt+E7w9Ju8k7L6+CnqI9nDpmViNU9cJKyf+:EjfrV9th4TQ9EIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357502, "uuid": "ae543d29-9dd9-42a5-a104-ef2fb6e58ee0", "value": 6185984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357502, "uuid": "2e130192-75e5-4647-afc0-a0a9026663a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357502, "uuid": "352aeeb3-d47b-4e06-b731-16ebffb80a92", "value": "d3c419262ca2d01fadb222d46078de258cbd7c33d7f090e74c27c12fccaff6ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2902f2ce-154f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356515, "uuid": "9bb3af5e-ed73-4bf1-997a-3d50ee401a45", "comment": "Malware payload", "value": "f8591433660f5fc14c5ba0fa9e7ef33b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356515, "uuid": "3e4dbafe-131f-4d1a-9ada-f82140981541", "comment": "Malware payload", "value": "d3fc5ffdd9a68a3063b1c8ff15334238dd39a63b9c93ec9f337bdd5f5357046a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356515, "uuid": "cd49b1e9-b7f4-4bcd-8549-abcc3bd13019", "comment": "Malware payload", "value": "15c6649f9c61828b77a7ff339b716a2326428119", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356515, "uuid": "dec3cbdb-2bba-4db1-abb7-b72d924af625", "comment": "Malware payload", "value": "fece2dae37777d627fb492d6ab4e40a4c4aeb4dd6ea9e1fb6905e938df3a29691e60ac01286d5d393cbe1b642d751073", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356515, "uuid": "4ab23c61-9949-490f-8873-e2ea251c9786", "value": "T1D3F5E056F345956DC4FA97330B3A12A56163CD268F83C6832D68733C69BB6C44F26F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356515, "uuid": "b1d0a7dd-d094-42a6-98b8-3dee1d19ffd1", "value": "98304:NJPWpIFHbn0eFakzYhZ1tcajGv4nXATVYmp6ut73r2:NRW0bxELgac4nFmpLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356515, "uuid": "cbadb314-da19-405b-90ea-a88cf3eeaa1c", "value": 3337733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356515, "uuid": "47aaa4e8-1e7e-4fa2-b62c-e6507ecac2cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356515, "uuid": "c753c090-3ca6-47bf-bc26-ff258df2aaae", "value": "VIDEO_28022026.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24176887-154f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356507, "uuid": "a2be1132-5926-49a7-a82b-48cac2ecda61", "comment": "Malware payload", "value": "287fc01f8ca6799eb0f9a1218b9d7453", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356507, "uuid": "eba58f3e-4354-4b9d-9d40-0a29f6824f56", "comment": "Malware payload", "value": "d431a07f847f644c84d5b0253f61a7a135f20acda1a6467c046a007ccc2992ff", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356507, "uuid": "630bfbad-312a-4b37-bcf9-0a57f587646b", "comment": "Malware payload", "value": "e3c34df0db7c51a9a3e2e0525dc5e3d4a7faca59", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356507, "uuid": "4432d5fa-d848-4707-a719-f9ecacc6d4cd", "comment": "Malware payload", "value": "d3a0bf99ea0cf65c4c91f58a197076aa4b529349297406b192b7b005c88caa3846b7f4f647896f71427daa2ea2732c8b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356507, "uuid": "5f5f1f17-394f-4bd4-801e-57db76997376", "value": "T148F612E6E74EF81BE077E5368E6A123391160E498783F7232905B20C5DF79849F4AF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356507, "uuid": "a723a6f8-7ced-4b4c-9b48-10953153e3fd", "value": "393216:xxsXL30THdJX7YfBEAyNynf2Fl/Avl7gdK2jDj8KyP:xxiwQfBZMFLAN52/jYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356507, "uuid": "d37a8d0b-2940-4a78-81a7-d6cd7726bd68", "value": 16420153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356507, "uuid": "767f446f-9310-4eb3-a82a-c51404669e3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356507, "uuid": "f3d97df3-edc3-4a24-b941-fee3d33e51fc", "value": "Drama-Live-v20.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9445561-1566-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772366663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366663, "uuid": "830f0f99-bbd5-4765-b03a-02632a2dc141", "comment": "Malware payload (Vidar)", "value": "3cef81985e8c577e4c012568ac97f275", "object_relation": "md5", "Tag": [ { "name": "pw-1709", "colour": "#F11873", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366663, "uuid": "041aa1a1-501c-416e-903c-3405292f9c1d", "comment": "Malware payload (Vidar)", "value": "d44fa79abd7943173424a0efc3fb6cedf586a5ce012354dd1deb008143ed9abb", "object_relation": "sha256", "Tag": [ { "name": "pw-1709", "colour": "#F11873", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366663, "uuid": "f7e91451-4404-4e3a-b846-8745ef7a8f4d", "comment": "Malware payload (Vidar)", "value": "2863906f86e49f95f17e15dafa2150ef4f1dab63", "object_relation": "sha1", "Tag": [ { "name": "pw-1709", "colour": "#F11873", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772366663, "uuid": "bbec51f5-0543-4f39-aecb-dac7048ba50e", "comment": "Malware payload (Vidar)", "value": "527d8f46bd0425c277c0599f7dae60e9e16633ff40827134e74660692de5c17bf898b8295a3cbe570fff8f96aa073cba", "object_relation": "sha3-384", "Tag": [ { "name": "pw-1709", "colour": "#F11873", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366663, "uuid": "0fe79b91-ed9b-479e-acba-2f9418339476", "value": "T177B63336A5C4712951C3C18474729A2CEDC15D2EA5A7DCFC8C16E53AB330A5DBBBCAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366663, "uuid": "4f5d6086-927b-4b44-b588-fadc01c4403d", "value": "196608:XYCqvgy/5SeEysJNi6c84J9Lk3GTaCj39NQXYwBz6TJ1n/fYt1iHKG7ADSd9y+v:Xu75SrYC2mgQXY46TJ1YPi5AMfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772366663, "uuid": "1940eb76-f8e7-425d-884d-db390f7d06b8", "value": 11438408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772366663, "uuid": "abfeb7a4-f926-4af3-90f6-833cc395f4a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772366663, "uuid": "84f97645-6576-4cdc-928d-34c2705e05e1", "value": "Tile-Sc3m[b0ot]2r.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb7bc3b-157c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376203, "uuid": "fab0ec95-9b5a-40ff-b5d4-877907ffbee7", "comment": "Malware payload (Mirai)", "value": "16c4d1ebf68b305b7b16d323009f55d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376203, "uuid": "c5ca1905-1f52-494f-b63e-de04853e2b6c", "comment": "Malware payload (Mirai)", "value": "d4e89c548f8d38d565e71ca39f9844b4f8dccdad655ddddcb332a1c1c394e89b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376203, "uuid": "abe7e5e9-f454-43d3-a07e-daf637d51107", "comment": "Malware payload (Mirai)", "value": "81925af1ca897acd7a8723257d90d6ede475d8ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376203, "uuid": "6d3eb293-729e-4547-bdbf-9ed3754b19f9", "comment": "Malware payload (Mirai)", "value": "4a3f62f9371c8167314d3412f8a0d50562825d153f4b2dd6f4533f70a0571c2eb54f4dec061df8c1122530df1dd9d412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376203, "uuid": "0c935a74-8b3f-45a1-a34b-5bd98d3a7807", "value": "T1E5C328C5AB43DEB3E85310F101BBAB324B32FC3A5826DA91D779BCB199515C0A60677C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376203, "uuid": "3edbbad6-fe7b-4902-9dec-170642cc0ce4", "value": "3072:DzBid9mXOriFh2EallAVT0lPj7qJqlLv:DzAdogHmmO8lLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376203, "uuid": "a3e4b017-0f72-46d5-b9d3-638828ce40d8", "value": 128616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376203, "uuid": "fd2521cc-0d6d-489a-959d-668d37409135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376203, "uuid": "0093323b-b65a-4670-add0-57a903969430", "value": "nx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394ae644-1569-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772367710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367710, "uuid": "40d757ba-ff95-4d48-b2f9-6298d176c834", "comment": "Malware payload (CountLoader)", "value": "8367bffc76e67dbbe2d560da2c0b5bd5", "object_relation": "md5", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367710, "uuid": "2ca64f24-20f8-4b77-abb6-05b3cc165bc6", "comment": "Malware payload (CountLoader)", "value": "d6c4d19e8ab26b20697bd35a5ec0efb227b318ee2cc3e03d9e5859d4e6564610", "object_relation": "sha256", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367710, "uuid": "94b0d036-78f7-4961-83b1-2035fa412bda", "comment": "Malware payload (CountLoader)", "value": "c7a6b8d8a57f6f86a009f5530b8b8144ce14f004", "object_relation": "sha1", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772367710, "uuid": "ec28793d-21e4-4d61-84d4-06ad18003710", "comment": "Malware payload (CountLoader)", "value": "9a28ee1ff32183e381f65f321ccda4860d37e04ec4469d95dcdfbe039f2e74547cb8dc91b927129055ad86a0145ef91a", "object_relation": "sha3-384", "Tag": [ { "name": "194-76-226-162", "colour": "#5BBC1F", "exportable": true, "hide_tag": false }, { "name": "37-221-66-27", "colour": "#B06617", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "DeepLoad", "colour": "#B850F3", "exportable": true, "hide_tag": false }, { "name": "explorer-vg", "colour": "#86C1A0", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367710, "uuid": "b8dd0e86-0c94-4776-b2ad-ef52b5259a42", "value": "T1F6B5237CB07255F9DBEC4CB53A49274727A10B24CF2C4BA91E3C25AE7E25746488AD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367710, "uuid": "70872db3-f8cb-45ab-a1a2-0e0d09f647f3", "value": "49152:kclWCqHdAJvYtwtpBHJWzZcWklpMPltH4yYuYSP99NDChhDX:AHG6SrBjpMDA8XNDCjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772367710, "uuid": "07dde2a5-f5d8-4cb2-ad0d-a6358169080b", "value": 2381157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772367710, "uuid": "7702f56b-7852-4f8e-b3be-e96093b07d9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772367710, "uuid": "a08897d4-95b8-4a0d-9ed6-390960db1817", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd34223-1551-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772357517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357517, "uuid": "4e031965-ba3f-47d3-96df-62e2e958cbd7", "comment": "Malware payload (AsyncRAT)", "value": "3a92c157b13d9b1c7393e69014e3ffb1", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357517, "uuid": "51041f6e-d2f9-49d6-bdb1-3abf6e50e40e", "comment": "Malware payload (AsyncRAT)", "value": "d72c53aeaf947235f1a3b22589c7746d49f5907424bbfa8325ec28c7230f9583", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357517, "uuid": "fdaad771-8598-4ff9-b5aa-6e593a576f21", "comment": "Malware payload (AsyncRAT)", "value": "9610b17ab75a9c95b70349c42b0c2fed600ace21", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357517, "uuid": "06de0634-9e5f-4e3f-841f-64385dc37588", "comment": "Malware payload (AsyncRAT)", "value": "71790a21223e1c5bdf2d83a36bc0cb29ac0d155cb529417585c033d849773c8eccaaaae68606d99541cbbb798622b7eb", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357517, "uuid": "e7ee099c-115f-446e-8d40-3dd98e76ccb6", "value": "T1665533830EE6DF6DD23EF7124172E72C7E121D524332AA506172D57BB85B01EA83F998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357517, "uuid": "5fb909e5-957d-496a-8540-8ed37f42437f", "value": "24576:faW2FrVC+/257t0+knwUkEtUJmf/Gh4bGi8iLUgL4ao+IYBmKz4L+jmWEn:faWeCvttItUM2h4aFiL/LmrO14LwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357517, "uuid": "d3449b1d-35b6-4116-92a6-284c6f9d778d", "value": 1395901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357517, "uuid": "c31e985f-301a-4a7e-9c62-0167edf699d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357517, "uuid": "4bf45dd1-6b8d-4c16-a5e6-81c7804245d7", "value": "d72c53aeaf947235f1a3b22589c7746d49f5907424bbfa8325ec28c7230f9583.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143f5261-15ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772396853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396853, "uuid": "1f5239c9-42b2-4cf7-afd4-f649c18b172a", "comment": "Malware payload", "value": "82922e11cda6af698a0dd340d2284efb", "object_relation": "md5", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396853, "uuid": "b475f4c3-c564-407b-a412-5391fa6ba00b", "comment": "Malware payload", "value": "da435aa17744f95e7e356e3c76d0caa64a99b55829095fa055b99885962273d8", "object_relation": "sha256", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396853, "uuid": "765c309b-e571-4d12-80ac-fbbdb444c0cd", "comment": "Malware payload", "value": "f93311f60928bb7dffdbfadb138c9142fad7fbf8", "object_relation": "sha1", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396853, "uuid": "c171d129-3ced-4a84-88eb-9487f2d3125a", "comment": "Malware payload", "value": "8c42085b7fef598d6cf6522d94de39dae2bc16078edbf2e691ad7ceb93db0f4085f89e7afbf4dbcecd7f45f5f04ed5c5", "object_relation": "sha3-384", "Tag": [ { "name": "pw-ryos", "colour": "#D57FE9", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396853, "uuid": "39e1d2bf-6ee8-4795-a2f2-8c70faa17dae", "value": "T1DE1633E686C5D026DB785C3C696E802045FDAEBE518158CAB1EC08C6B315F0A0FFDB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396853, "uuid": "e4d13e5b-a1fd-41f1-90d7-ff1858743464", "value": "98304:V1ehVp+lmx2rB+tbiecMB4NsdUECoUjLOL+N:Pe9Okiec3sdojLa+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396853, "uuid": "06ffe7c6-6db6-4326-92f7-907ae3753038", "value": 4292607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396853, "uuid": "cad6432b-069e-4fd2-ad7e-0ffc3072ef0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396853, "uuid": "6302f9bd-ab4a-496d-96d7-1a8acaf80cf2", "value": "Bootstrappper-9.996.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4d287f-154e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772356147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356147, "uuid": "4f572be4-1391-4ebb-98fb-eca97a69addc", "comment": "Malware payload", "value": "8a2897ac0ce1e18d4cce69eeddd610ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356147, "uuid": "b122513c-7a07-43d9-8ded-c1e94bb79fb7", "comment": "Malware payload", "value": "dd0266f28ae6f990c1f7e15d9766a43b51db881f7c0e22d1c2a86976fa18a4f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356147, "uuid": "c3f290a5-d092-4292-b8ac-aaa94e87b070", "comment": "Malware payload", "value": "3eafe432f3f800e36f105cb1b8fb36bab3e582bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772356147, "uuid": "ab2c3439-5f7d-4858-b1d6-da2ba69fe06b", "comment": "Malware payload", "value": "d1e3e9821f1ad91e748936d927dd23ff03dc1033b8bb0f640a4947797e10af04fd5c574e8133938960df0b83417604bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kurdishmyth", "colour": "#99141F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356147, "uuid": "695be12a-404d-4fee-9288-2dd4757426fe", "value": "T18108D01663A116AAD97BD1388AAB6503EB73B4071330C7DF329C43712F63AE45D7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356147, "uuid": "fec3c722-f4aa-45b7-9bbe-dd09d4b78076", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356147, "uuid": "409734d4-587e-40ed-8a2b-b90ebe51caf8", "value": "786432:a5EosxTUU8XOkBKgPQ9URV+cWV1CVu+woz3fGxKLTBRWYF3eK9iwo2:a6oslbkJIURV+cK1C1PNXO1wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772356147, "uuid": "cafab634-d54f-46ba-85c8-88703150ea50", "value": 80863089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772356147, "uuid": "4f167b06-36d1-4e2b-9b42-2aefd8f63b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772356147, "uuid": "d681eb07-4f1f-4aef-afd3-ebf89c2d0179", "value": "dd0266f28ae6f990c1f7e15d9766a43b51db881f7c0e22d1c2a86976fa18a4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6336d7-159b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772389512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389512, "uuid": "e900b10a-5ac6-42e3-a383-bf9ee08755b7", "comment": "Malware payload (Mirai)", "value": "63447cda1ccf6cc2a84d58c0745f5952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389512, "uuid": "b1903c8d-7ac2-4bd5-9dac-df28504f407f", "comment": "Malware payload (Mirai)", "value": "dd52d16cceebd3242fd59b0ef4c61b6a226d8b226b667974330a1b80f8358797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389512, "uuid": "fbf6431b-32f6-4a29-8b1c-2c1cfc3792b6", "comment": "Malware payload (Mirai)", "value": "845adb899a87c108848814c713c94915d55b2d90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389512, "uuid": "e8544ecc-1598-477b-81cb-2c8c7fc96cb0", "comment": "Malware payload (Mirai)", "value": "0bc4a5cfbc9354add650179546ec23024d45c0a8bf58a8088a88ef729795d28fe476c6cdabe3a1287851a5f6858157b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389512, "uuid": "42867f66-a029-49da-91be-5c1bacc4e989", "value": "T1C9E533489111A32BBE7B8CB4B19497B3BA6D11FE6E5961D0C0C4E40F7DB91F442BA07B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389512, "uuid": "e89a254c-67a2-4f9b-bf9b-92785c1a5b6f", "value": "98304:Rv3OS38wRw6huUUJi0QMRTEV6gP3DIBw1T:lXrhuTJJRg6gvD4w1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772389512, "uuid": "58529c5f-a994-4095-92eb-d8bbd7abcd21", "value": 3290788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772389512, "uuid": "6a7ee173-7707-4e95-8353-fdc8054243f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389512, "uuid": "ba1fff59-5134-4a4a-a393-3c7ba5228d42", "value": "fullgc-linux-aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fbe4d2-1576-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772373559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373559, "uuid": "8fdd5ee1-4756-424a-bfca-e731fa2253fe", "comment": "Malware payload (AmateraStealer)", "value": "37a6ce70c55dc32d4f4748023343b6af", "object_relation": "md5", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373559, "uuid": "4794884b-ce36-40ed-b9eb-f1597059cfc2", "comment": "Malware payload (AmateraStealer)", "value": "deb5aedab0620df85aa174e6bb5c8a22eb31e4108509c21565a5140c5f375608", "object_relation": "sha256", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373559, "uuid": "845d9c33-00e6-40c3-b2d9-0714ede3de2b", "comment": "Malware payload (AmateraStealer)", "value": "4b1285b88b7d159a3978464eae39d50095f07aef", "object_relation": "sha1", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373559, "uuid": "ff31f148-2168-4d09-a90c-32519b1a1870", "comment": "Malware payload (AmateraStealer)", "value": "8be711e0a532e365b4166ac5d09c5e570e285ae1514e562a2c47d7f88bdc07770b0ebbc7188239f60a52c1f022c448d5", "object_relation": "sha3-384", "Tag": [ { "name": "185-121-235-118", "colour": "#FEA3DD", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373559, "uuid": "a4388561-03f0-4fc9-95be-122aa2317f57", "value": "T11975F1688E5B3C8988246CD6C252B1426FB5073F6D3CD48777A23D41622F71ADBCE64E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373559, "uuid": "bad03941-9c14-4894-b99b-fd8e3fc2e838", "value": "24576:kUvfB9uX+EpkhIh2y1aYpPr7zq7XruhxHPd2bDqNdkufejhQXVp4fFtUeH:0+KkfMxHaDAiQmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772373559, "uuid": "351cfc9a-e649-4018-9500-5eeec1c845a7", "value": 1569680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772373559, "uuid": "8035bcef-c36f-4b11-b36d-c06c378bd2e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373559, "uuid": "c834e7c0-257c-4345-bff5-78c73d8a74c4", "value": "chuh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45fab76-156d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772369742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369742, "uuid": "aaddcf77-595a-4bb9-a6cb-c13be629827a", "comment": "Malware payload (CoinMiner)", "value": "f213ea658b5557014d284ee65be49eb3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369742, "uuid": "e017266e-4ba3-4627-a3a6-14f48d4a66b4", "comment": "Malware payload (CoinMiner)", "value": "df1e8bfc057af18951f1c3383549c7108b4371fa610e2fb88b5223b156f5c62d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369742, "uuid": "d1e9f38f-ba87-4905-b9b6-03982f7e4c95", "comment": "Malware payload (CoinMiner)", "value": "ec1a4c56b496a0d071906cd9ccbf2c44aa765cfe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369742, "uuid": "acf5e5dd-ab97-44ad-a0b4-a70086b5b21b", "comment": "Malware payload (CoinMiner)", "value": "aa07f073f8de211407ef1ad3b32230b4500f34c3732cef676ccbf46a182cf134ffe605ef4aa159ee5678a27783ee52f7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369742, "uuid": "b0acfb74-ef2e-4ba7-ba24-7d26ad3f2161", "value": "T1B635CFC7E3582145E2E342B768E582C2BF3D656837525DAE242DC4E813430A663FF7B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369742, "uuid": "3225d63a-1fb1-4c2c-a574-121580b0f340", "value": "2c984f0d2dd3f6fe2d201cef0bc18aaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369742, "uuid": "628c96a9-8908-40c9-9455-1d77ad5b48e1", "value": "24576:Oa5fFG7dzJqpmuEUL2hluHDZg96YMUg+j:F5UdJGwhllNMH+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369742, "uuid": "2bcef95d-8e4f-4a07-a478-8f2dd08c5ac8", "value": 1072019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369742, "uuid": "fdbcddec-40bb-4680-b452-bc7a42dadd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369742, "uuid": "ef150656-d629-4c3b-9985-daa0ea3f19ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08050a3-15c7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772408390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772408390, "uuid": "6a3b972a-3f5f-40f1-8187-431df2021657", "comment": "Malware payload (Mirai)", "value": "371845e8e28f18e28d0885dfcfba028a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772408390, "uuid": "d86bded6-aebf-4252-8d68-625f5f26d7c3", "comment": "Malware payload (Mirai)", "value": "e1e807781ad5cb219c316165b76be666cafb09e798077ce12c45fa49057f15b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772408390, "uuid": "13c78622-f759-41fe-b781-5c012143413e", "comment": "Malware payload (Mirai)", "value": "a74c1dd1ecc6548d89e80479cd18d47a1dd6cbba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772408390, "uuid": "d612a817-978f-4e63-a545-54479bc666c6", "comment": "Malware payload (Mirai)", "value": "0ddd35b01c1c38e23f65b78c4d99399882d6b622339fbc74caa3135a84ac73171f0aa366ce8aff50a9e35c31d77f1be9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772408390, "uuid": "faaeda40-eb92-4465-a7fd-eef2a3d0d42e", "value": "T196F46C1BB2B3B4FCC057C43047ABD6A2A935B46512226E7B66C4CB303E27D741B1DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772408390, "uuid": "9ac807c2-2f24-4d6a-a86b-0e59de08a492", "value": "12288:i/yBUgW6Qd/h4ktkvPpyCcWyQTQNpDKAWyt589l51:bBUgAdZ4ktkvP87ETQNph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772408390, "uuid": "a5c82b78-6d4a-4377-88c8-af7fb87f4532", "value": 764840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772408390, "uuid": "2061f4b5-e817-4c58-8bd1-0e02fff21c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772408390, "uuid": "9cd387a1-43d9-44a2-99a6-7b0c6e0b20aa", "value": "nullpointer.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeee31bc-156c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772369303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369303, "uuid": "9a15383e-f35a-46ff-800e-ecaee5c4b07e", "comment": "Malware payload (Vidar)", "value": "707eb65db6787e38eac9775b07ea773d", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369303, "uuid": "28da93af-bb83-49ff-9ce6-7b6c25576dbd", "comment": "Malware payload (Vidar)", "value": "e1f0978feb782a50cc29f72901fe23fcb991691d0f92038a0563c848084fa7c7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369303, "uuid": "0b0ce1a8-7a85-4e1c-a5d7-3c9fd25e8cb5", "comment": "Malware payload (Vidar)", "value": "a6cc7c536b0de1e50640db2827da332a0952c133", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369303, "uuid": "7d171c5b-e59f-442c-b7ab-9412768d4ca1", "comment": "Malware payload (Vidar)", "value": "ec877eeb1c6ce8b72d3e4f8210c3f96450267dc8c79bfe5e0538fe159841014b276a0a62c87d9fff4cfb1707d88e9f5d", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369303, "uuid": "de54dc34-fcf8-4563-a7a2-84e41509f8b2", "value": "T1A1B57B5B7DD51CE6C46EA7B28DBA21813734BC490B3233D31E54BA782E726D09D3A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369303, "uuid": "32ba9a84-35f3-44a1-a074-c344d05ab5eb", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369303, "uuid": "13f47af4-ff38-4ec0-9cfa-1cfcf8dd6e55", "value": "49152:iJgL+Ro3Cw5lcVcwFtBJNerguEEJKuZ/UUzy:iJNOF87uEsKwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369303, "uuid": "488e64bb-9a7c-4f95-936f-f7b8b4c67739", "value": 2402304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369303, "uuid": "eef5b1d6-5298-4512-8a0a-7f846cb623c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369303, "uuid": "017660ec-ae88-4124-83c4-da6be2912139", "value": "Setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e94de1-155c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772362342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362342, "uuid": "02a16c24-3e17-4cc3-9f3d-e6c4bcb70646", "comment": "Malware payload (AsyncRAT)", "value": "81c5a103cca60f434248f4e85a1f0145", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362342, "uuid": "e084d8a3-b8f3-47d2-b09b-8eb7d2e35268", "comment": "Malware payload (AsyncRAT)", "value": "e291078023f902c380b0e6cef294dd05d36d21e00ecf4756f7a038500b9cb28a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362342, "uuid": "01424d41-f7b0-4cad-ba0f-f65d0ea45ce0", "comment": "Malware payload (AsyncRAT)", "value": "6193ecf5045669f6d7243e645071a01f2ed82ba3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362342, "uuid": "144a1fd2-8204-4234-90a4-ec885fad56be", "comment": "Malware payload (AsyncRAT)", "value": "266bafc3d41f6e344f79903094d8dc3ac179c36399a857229aa140be0d4a1e80c30a61b12301337e2d70c9cedd831c3f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362342, "uuid": "188f694a-e40a-44b3-8c57-d6e9c98cc9fd", "value": "T16CD20953A6AC05ADE1B393B5C9725E01C776BC164BA2A3CF8350916E0F297C1B936F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362342, "uuid": "aced72ef-10ab-4b73-9086-a97f71ac0a0e", "value": "994fec77863c87e5e434d9b420e4b3a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362342, "uuid": "0880e69f-8a91-4e65-be6f-f8862086278c", "value": "768:6qaDHqo4IgOWO6XfGg5hFb5Sxkpkh0+Yj2mLpUb5pCpayX3Qgis:6qYHxXdhmfjz10q5ot5pCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362342, "uuid": "01eb31b4-7cda-43f7-b235-8e83b0d7f74f", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362342, "uuid": "a98cf6e8-bd9c-4142-aed9-02ec4b346852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362342, "uuid": "e60949d3-b952-4be7-a1eb-43232ea986d7", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc59265-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772396411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396411, "uuid": "89ae7a9c-d65a-43ff-b27e-d103977353d5", "comment": "Malware payload", "value": "dcad624aa955b271ba29f0a9bce63834", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396411, "uuid": "93d7fe00-dd7b-480f-ac6f-d4a043ea712f", "comment": "Malware payload", "value": "e2931cd3783674b767fd7b1702ff61f9e44658b35b22b1605e426947e9fe5e92", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396411, "uuid": "bd4f4f7f-f7ee-4abb-84e3-3de09022f9c1", "comment": "Malware payload", "value": "c41e77345da2b336b7856a1e707b8d4785fd765e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396411, "uuid": "f0465aa9-fd52-4d3b-a536-a3206d005edf", "comment": "Malware payload", "value": "27e95c92daa87e2632d67bbaa323b7429345caea6179971ee777513775271cddd99028e6eac21e7c8240116bfd59447e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396411, "uuid": "deb916aa-781e-4a80-98d4-d7a5664d4980", "value": "T198F0DD16A9797D066330CC1E83A46A0E433143F1F98CAD1BD1E29AD32E6C4C63157E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396411, "uuid": "46f7169c-9433-4e5f-a6e8-d665694213d1", "value": "12:8q0HsOt1VvhsqNxtzYFcOpsGLSUtwOkYV0VyVIVs6X:8RHsOt1xhVtzYFfnGOJmYCS6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396411, "uuid": "f792cba7-5a54-4e93-b13b-e8d033ecf0df", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396411, "uuid": "e8c6c04e-b6da-4c84-a55a-078803635e70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396411, "uuid": "f15d8beb-14ce-4f9e-9df8-d55647074e1b", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8794dacf-1576-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1772373425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373425, "uuid": "a035741b-7226-4c6a-94b7-349b63628c70", "comment": "Malware payload (ScarfaceStealer)", "value": "1fd6371995dab4bf2b3ee179e4312df3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373425, "uuid": "43001b5b-7ce7-4446-98e2-13712724ae4b", "comment": "Malware payload (ScarfaceStealer)", "value": "e2fb4d5936e7d7e6d1f620d3ed07725d8948e07a8da64468aa0d2a4de6c6cd66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373425, "uuid": "69320568-34fd-497b-9c0b-40c92c866a75", "comment": "Malware payload (ScarfaceStealer)", "value": "c8f3a764d1c4581f4ee22abcabfbe93c91a813a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373425, "uuid": "21899302-8942-442e-bfae-82215e2a6c89", "comment": "Malware payload (ScarfaceStealer)", "value": "4840e7b052ff876ae2746602617db2a008c509a0f3d6b9973c533222ca71a30c7f3534e8f8dd5816c8267b0b18dff500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373425, "uuid": "effa2854-b4dc-4ac3-a369-b648ad4ad41c", "value": "T1DCF7594262EA05C4F9F7DA358AE65217D673BC166F3081CF325C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373425, "uuid": "97937890-1de1-44c8-acd6-8ef5fc8ef93a", "value": "772ec87d3452991a9933a3ba0d9963a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373425, "uuid": "815340b9-0058-4913-8c77-6fc4682b0ce7", "value": "393216:8n1XQgPR2k3m5C507G9ITEc5eAlkLbQurxMWhAsIyNOPS0B4AycWsCYaxFzwW/tL:81XR7AsxYqt2oRGj5rs3wb8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772373425, "uuid": "f384874f-fd73-499f-8217-6f06bc394907", "value": 71366656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772373425, "uuid": "7a8ea2fc-b0bd-44af-9b3d-628afb02a9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373425, "uuid": "6da7bea1-a0c5-492d-9c96-efa3bddccfc1", "value": "Latest_Software_v4.1.Last.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf883f6c-155c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772362351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362351, "uuid": "bf0e5fe0-614b-4c96-bcde-6e38bdb567b6", "comment": "Malware payload (AsyncRAT)", "value": "2564ea5bbfcfbdfe7aada99aae80c8e7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362351, "uuid": "66784417-d473-4047-903d-205c4a7831ca", "comment": "Malware payload (AsyncRAT)", "value": "e317bbfc8dd60ed01c0d2eb675d513b3ddde788c8a63a3e8444dd03b85eb31c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362351, "uuid": "482868fb-e6ff-42d6-9575-a0cb193694b2", "comment": "Malware payload (AsyncRAT)", "value": "b6d515a0ea8883bb9f3d09f8ce01bd82ab43600e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362351, "uuid": "c938532a-75e0-4800-b120-3890d0c7e031", "comment": "Malware payload (AsyncRAT)", "value": "935b8b13e58780d26dc622e0c76e4b656ea92272ce76528ea8f2c24cd20ba7c888082f832a78cc1d19c813291adb562f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362351, "uuid": "332d40a0-392b-480c-918c-e02dfb26bb40", "value": "T1A9F6122232D55E08D0B387F806A2D9B997337F1A2535D25A20F5BE87FBF39424C0665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362351, "uuid": "8bd8211a-2471-4a4a-8d11-3a506209a401", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362351, "uuid": "2326bc69-5915-4dd7-a4f9-8c1a2570898b", "value": "393216:T7F7QNH3hGZSLoMkCLQMWu0VwCnzo+vSe7PEmrkSB:T7F7SXn8cQMWuCzie7P9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362351, "uuid": "0ebe53df-4140-4386-a0f9-15f396948694", "value": 15543296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362351, "uuid": "3a00a10f-dbd5-4067-84d9-5fc4223a3a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362351, "uuid": "d5af5b07-6fd4-47d4-81a0-002164783679", "value": "64th Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd822be0-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396815, "uuid": "6e1923b9-bee3-48ad-b169-9a8b4d92391c", "comment": "Malware payload (Mirai)", "value": "ccab8f88bb3600e1e534c6c577034d66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396815, "uuid": "90c19df9-f0fb-4eb2-8acb-6e7db7c14bab", "comment": "Malware payload (Mirai)", "value": "e3ff905f1ffd2f431a5395635a33252a815b6e9b82681276e4916942fc84c2b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396815, "uuid": "7a463a74-4db0-4ff2-b3ad-89820a0748a0", "comment": "Malware payload (Mirai)", "value": "f98c3b3baf041992d96fdf469b6115c24013d3d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396815, "uuid": "7514264a-c477-41b6-827c-6b6b0ce1de61", "comment": "Malware payload (Mirai)", "value": "cde041a78136e9751d6279d1a1c50ff2ad96561d8f0ffa897db19f6077c9769223646136ecb31d7c6dfa4c25e724d195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396815, "uuid": "9f1122e6-6e76-48c1-a164-0a277ce85868", "value": "T14EB36CC4F743D4F2EC4705B05876EB369B32F479192ADA82F3649B3DAC62501DA0A65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396815, "uuid": "8a237f87-4423-41a5-8093-3fcdf4fd35b5", "value": "1536:dw7whN/occ/tCigPZ0EZBNhTIJDSYXUwl0jSNhqMClNhsEM:dw7whFc/MigPZdthTQDNXiuGHhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396815, "uuid": "5f9cebdd-b836-438c-b6ce-47f4fe54f7aa", "value": 116780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396815, "uuid": "079df3e8-79a9-46bb-b4af-6e1ea707624d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396815, "uuid": "e67af101-2dd0-4d70-a3cb-348d1d661343", "value": "csk_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e89d03-1551-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357527, "uuid": "0298a8cf-ea0a-48a0-a2c4-4fed5ac82d87", "comment": "Malware payload", "value": "2c650f5060b84220b6f81756a5d87cdf", "object_relation": "md5", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357527, "uuid": "fe8f3951-7b1c-40ea-a05d-1711db18d678", "comment": "Malware payload", "value": "e57e46529ab9d195874d2895f9acdb353b4fcd5321a3e46f66d0bccbd94af5cf", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357527, "uuid": "45319871-c919-438c-9066-1cc9067949b0", "comment": "Malware payload", "value": "741eccb72b7742db21edd98ee358479020f72d19", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357527, "uuid": "1af6a751-55a3-4ef7-8f72-2bfb5cfac738", "comment": "Malware payload", "value": "9163c898d3b511e189bd065c82382756e6b632e6907f7ebe5fe12b75b3eee647f8697a4f7be1ea7150def8e1c8617797", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-10", "colour": "#E063F4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357527, "uuid": "293adec4-1adb-4418-bc71-e0aded3fde13", "value": "T1FCF0BD5445D1C2D17CAD5065F3A35D71495F5E4319071F07158C55F581CBE101CD2375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357527, "uuid": "d0354823-f044-4291-918b-b815acd52509", "value": "12:oEOrn6MzBqQFSWPFYtJCG9gkjD37xB3R8hV4t+GiorIBe16:ZOr27WcgGSw7qzb+IoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357527, "uuid": "ed252c2b-6453-4c59-a203-17dff98857d3", "value": 640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357527, "uuid": "f6f77d13-d148-4ecf-801b-02b52fcd2887", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357527, "uuid": "719120fd-5d5b-413d-ab23-02d3e7d94fa4", "value": "e57e46529ab9d195874d2895f9acdb353b4fcd5321a3e46f66d0bccbd94af5cf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c88270-1593-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772386063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386063, "uuid": "31bec3ca-7403-444e-b4bd-ebce01c85631", "comment": "Malware payload (njrat)", "value": "bf6df4c4b9188344931292b6fb13e08d", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386063, "uuid": "6c6c5945-8894-4e63-abff-58462a1d826c", "comment": "Malware payload (njrat)", "value": "e600465e10f9ae577b1400ec378ec1a287303f5954f98b35602220fd173f9735", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386063, "uuid": "eb45228b-c2d4-4a9b-b9ce-f15b6239f8d9", "comment": "Malware payload (njrat)", "value": "e1ba46a0a70fc5933f88490a68a106b1ecd79584", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772386063, "uuid": "cb48188b-f0ff-46d9-8598-774aafe894ba", "comment": "Malware payload (njrat)", "value": "8f7c937d19c52436d220406e021670e4b58a15bf5ba560ae540da3ba8d6d36477937e7f05ae2c95eca4ece9b6044b9e3", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386063, "uuid": "1d4571bd-1508-403b-a122-63b66a717ab4", "value": "T144A4230F78178D2CC467D5BDB17C9311DAC829DAD253860096E58421BF8AFFE2727DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386063, "uuid": "15285cbc-bb0f-4b38-b542-980944cdb235", "value": "12288:VO5McCEBL8scH+VD/Yrm6wWg4FVnxr0Jei1vNL8sc+:FscH+VD/omHWg4pr0J/ssc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772386063, "uuid": "e37bd791-22c2-4faf-8513-ae9ae96dc54d", "value": 479052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772386063, "uuid": "b1bc78c5-b693-40a9-85b2-a532d0ceff7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772386063, "uuid": "4864b1cb-bfe3-4005-98b9-37e7e805549c", "value": "Velocity.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f33ecd4-1550-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357009, "uuid": "32f59600-dab7-4e78-b6ea-f56f1734075b", "comment": "Malware payload", "value": "7e567053d2479657a8e458f5cd7190e2", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357009, "uuid": "ce2d2c05-5f90-4dba-9a17-2167263aecc7", "comment": "Malware payload", "value": "e716bc159c66ac10a50c321c9461047c00dc61af263d729fd3af33f7f475efa1", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357009, "uuid": "f5e29005-4c38-4d79-8501-ee5b32964fb1", "comment": "Malware payload", "value": "0faceaaaa0994e10f8be2a7417364de4f4597f1a", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357009, "uuid": "02f33b98-7f0a-4cca-9947-7c08f23b34c4", "comment": "Malware payload", "value": "553345071f59e763f18acfe0b7afc1cd92a7072c7870b119da1704d8622107cd8556f0a5ae8b0e4422057c60ecc724cb", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "wsh", "colour": "#92CD9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357009, "uuid": "2a51ab39-76d5-4f0e-a612-7fb34d843cb4", "value": "T1B2B092E559CBE3926952622FA474E15870D190A6A162F4BB67098B2FE281590841E0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357009, "uuid": "355eace0-c00f-46ba-846a-cc4ac677cdba", "value": "3:lP/ErULXOD2RIPGETJL18P53yzruog7W6WFL5vhc7yn:lP/ErUi+IJL2pyvTJc7yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357009, "uuid": "faaa7d29-ddf7-4855-9638-0dc66c9c3491", "value": 123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357009, "uuid": "5afaefa8-cb27-4a56-b7af-31d07f3db76e", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357009, "uuid": "61450bb4-f3c6-47e6-a157-7de6bb3ddce7", "value": "qjbosvb.wsh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae72fa80-1592-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772385516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385516, "uuid": "8306789c-addc-4c87-aa50-f8c35ab16cf1", "comment": "Malware payload (Formbook)", "value": "07c9df058d713bf385508f6196dd9bc9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385516, "uuid": "7f0e23be-3943-450d-926a-f0ae9c421b86", "comment": "Malware payload (Formbook)", "value": "e73da7c07391370c9038aba9b81896a8a796bad3d99f127851fbf5c80130e371", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385516, "uuid": "6b1d5f85-23f2-4b8b-96f1-dea4400ed949", "comment": "Malware payload (Formbook)", "value": "c4fc3b1884db02c708bb4e9b0b3428b6276804ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772385516, "uuid": "75d17211-b7a9-4af6-b3c5-8e615271d025", "comment": "Malware payload (Formbook)", "value": "239d655494b6efa1fe503d7ca78b92465edb7eba336822b0eeb52e738be1375aa3938b9974b24d3a4837e177da3abf5c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385516, "uuid": "6a02eea8-5459-41f6-864d-f495ffbb4482", "value": "T1AA25337531A481BB0A147912282873EF4D541E9BE52AEB0FE9E07DDC987B7B6710CC8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385516, "uuid": "1cca01cc-db1d-43d8-a52b-b67c4e079483", "value": "24576:tb9s/t7D9wGnZeSS1OvSOP5vaHAY3OACQB22TF3qv0aK3:tBilJwyZWIvHP4gIOAF2Sw0ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772385516, "uuid": "23b62f54-65b8-4411-a7d6-46d6c3e6cc46", "value": 1005663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772385516, "uuid": "0712cca6-f071-4f6c-9c5e-11e05b1df6a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772385516, "uuid": "9d90a55d-63c8-43e2-b8a8-1c00b4e6eef3", "value": "01032026_1629_AWB.bat.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a6e8a0-159c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772389662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389662, "uuid": "a5142a67-e56b-43a0-9b6d-583ea3b4bfc5", "comment": "Malware payload", "value": "7411300f2ccc331e85159a0ad10aebe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389662, "uuid": "8b704b2a-2bc4-4156-b8ef-0e2fd87421a9", "comment": "Malware payload", "value": "e898e5c1250f7a232f17aaa765f99acc42d0f7a4fa0aed731be95029dc5c988d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389662, "uuid": "02064adb-fc21-4dcd-b6ba-23017820ffb3", "comment": "Malware payload", "value": "cab952697d232103d1fb4e3388fd431724c58f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389662, "uuid": "3dbd4cc1-4ba8-4242-a1ef-005290d0f96a", "comment": "Malware payload", "value": "c8ed35b06180c51bf378c66d7d243da11bf6bdcf901e1d0c4e11689cd2489a36998ae9a3c8022c35b592bcc5313c9ea4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389662, "uuid": "a5e46797-ac6b-4518-ad71-c8787d6fe34b", "value": "T14EE6182B66A28568CD5DB23AC3B2CB00D4FF70B907F3C7E7966313681E565D05E7A224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389662, "uuid": "d30aa806-d153-487a-ae6c-8b99acf21f04", "value": "9c852624a95579595d84bfcfbd14cb95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389662, "uuid": "b2be6db4-e8b3-4246-b676-3686afe8d102", "value": "98304:1fbvYfLRXJbWCnIJjJd/8+puNrVcgJVrdQI:1fbvMXyocuNrVNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772389662, "uuid": "87856d52-0054-4496-bb94-ec0e520688b8", "value": 14246400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772389662, "uuid": "63572e0a-0137-4aee-91ee-6823f266e9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389662, "uuid": "72e226c2-6564-4c47-93e2-f369c3f098f9", "value": "SecuriteInfo.com.Win64.Evo-gen.55524192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891dd1ae-15a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772394902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394902, "uuid": "c4f4074a-212b-4227-8bbe-c0ebaa26dd25", "comment": "Malware payload (Mirai)", "value": "c5ed1f0bdd30372fa67d56c6da520908", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394902, "uuid": "24c06d55-7719-4d86-a4b0-33cd851b8bab", "comment": "Malware payload (Mirai)", "value": "e986942fd31f5fc31def410529a0102a86cd990a7f51498af968fe0eb44f9d39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394902, "uuid": "79cbcdaa-69c9-4f67-924f-d9f997f98f66", "comment": "Malware payload (Mirai)", "value": "db7758c523afec28899bf5e8ca88afd053b53c8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772394902, "uuid": "48952d56-c279-4dac-acc7-790dd91d6b7d", "comment": "Malware payload (Mirai)", "value": "31930b79003600edc921ff98ebd098e6a158fe76d4c4e003e63f4735249adb3dc59f2c40f906c4c1efedee3a844cefb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394902, "uuid": "ffabe875-cafd-41b4-bcee-351429966766", "value": "T1240419C7F900DEFAF80AE73748530909B130B7A104929A777257357BED3A1990977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394902, "uuid": "588dc481-f643-4af8-9f4f-4ea866c84986", "value": "3072:ka7H7Ds2MlBdZphM4gihh8Dy92CqdBWdFVaJqMuV3GH37V3jbi/L8uzqKg:t8a1ICy9RqdBWlaSV2H3qLl2Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772394902, "uuid": "14ffeb53-2f8f-490b-bdc7-fa1be463b9ba", "value": 181380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772394902, "uuid": "42bd70a8-7fb1-4b45-a2e4-5f450445f787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772394902, "uuid": "658afc57-315a-4cef-b26b-a34769901ebc", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083087ad-159c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772389532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389532, "uuid": "f6c592a5-f02e-4592-8a3e-d238699a1fea", "comment": "Malware payload (Mirai)", "value": "8c57fa3e8e3689f0706369747dead368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389532, "uuid": "e85da3b2-b7f2-4541-bb2a-e4f39d20edce", "comment": "Malware payload (Mirai)", "value": "e99315f6d267ecd7b5fcaeaa6057a8db75f66931dad11a99f90e4d665907dbea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389532, "uuid": "254481ae-c9fe-465c-a176-a98bb85ba5a8", "comment": "Malware payload (Mirai)", "value": "5f1297dc8cc32a378a3a1795abbeb87c51b5ee12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772389532, "uuid": "72185ca2-fcb5-4aab-a7cf-6efbb827e615", "comment": "Malware payload (Mirai)", "value": "d57bc824153f741e39ea6dda97cb91e3459920a5f31d452e55df8ce2829cc9cdd290a45f3758ab0c317fd0341934c3d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389532, "uuid": "c107c95c-6dc4-47bc-9190-4b8871e77acb", "value": "T177865B47B6E318FCC19AC470476FD663BD7078984221B97B7698AA302F67E205B1DF21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389532, "uuid": "a649e35c-ca8d-4e60-9212-ead35f57db72", "value": "98304:MofgQSAoSuo2FukvzX0pA0xFdmKkHtK9jRPEvsB+lBNPIgOd45/jyfXnJMCQv1Va:dg7sB4Wdjw92hN9OsGItB6Og7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772389532, "uuid": "fdc34849-1322-4535-912d-49c69b8065e2", "value": 8338672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772389532, "uuid": "0b59c6a6-974e-4cb1-a8e1-cb6e0ec0f932", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772389532, "uuid": "e2032b60-9331-4e5b-af9d-639f37d91a68", "value": "fullgc-linux-x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711885d8-1517-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772332585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332585, "uuid": "e5e414f9-886b-48ad-9be2-4d5c71d3d1d0", "comment": "Malware payload (Mirai)", "value": "220e116f016ecfb812f627d2f1132d7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332585, "uuid": "4162b55e-8222-47e7-a021-91d82c45b90f", "comment": "Malware payload (Mirai)", "value": "ea08edcedb7c92d5feab438657125dfe76762d8eb37aeadd5e723136d870c90f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332585, "uuid": "f80abdbe-a6e6-4561-91af-91d6cce7bf6e", "comment": "Malware payload (Mirai)", "value": "1657453d58633594425f8dbd42c7a6633517e3a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772332585, "uuid": "ff0d949a-348c-4bf0-a58e-8c0ee6bb4390", "comment": "Malware payload (Mirai)", "value": "1c8b85cc1265f9f5d489f7bd7474eee97c57cfc0dbfb53c3cfc24c8e0c9b90d5c61bb995806af7f6b6ed8d5465349df0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332585, "uuid": "b17e36a9-ba3b-4b36-9e15-2442a3612c59", "value": "T1FD041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332585, "uuid": "5613999d-7293-4ced-b134-825cd61345ea", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2woriErou0fCtZ1SD39rsJz30s9fx49SYT:t3nEr5dfHPq7UTo2Ecw3K9X0167", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772332585, "uuid": "3db46a6f-2163-4fff-baf4-4707ead11380", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772332585, "uuid": "5cff29c9-4f98-4d87-ac5f-4c0d7360f48f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772332585, "uuid": "9e3b157b-dc40-43d6-aaa6-8e801d1a78e7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ffd087-15b1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772398631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772398631, "uuid": "d693bf52-a5d1-4e7a-bb41-48104b4ed436", "comment": "Malware payload (Mirai)", "value": "2d5448f4013009de4075a6c7a8a0f411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772398631, "uuid": "51622ca7-26a5-43a7-a21b-b732c716ae07", "comment": "Malware payload (Mirai)", "value": "eae911fb5ea5cffc4af1b664460fdbb7e734c2a5f7a388b144d46638988481e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772398631, "uuid": "914e5336-17d0-4ef6-bd44-2b85ae9ded8d", "comment": "Malware payload (Mirai)", "value": "c6132bc18b8b8447bb93c793874ea26f5ad399be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772398631, "uuid": "5fc8f838-bd3d-4808-b982-10cbb9e094bd", "comment": "Malware payload (Mirai)", "value": "398e8e43b3dc54f6dd84487143a39a16db5eb944291396f1808d95103cf4c845d40b3c7f562f88358628391a9dbc1049", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772398631, "uuid": "d7b5dba9-f0f6-417f-b00e-66500fe5dc41", "value": "T1D724B60A9F510EFBD8AFDE3342E90B4625CC651722A83F763674D924F54A94F0AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772398631, "uuid": "02b57e73-5892-4b0b-98fe-4e907d1196d3", "value": "1536:iPV3JuT6fovqkfdvmvUpS4GPU47d1DTruZWcQSeXxfmHLDUSIjBSD5185Zx+4asd:Tw1kVuMpSb5HqUSRD2NfVsb69tq/t0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772398631, "uuid": "d447a335-98b0-4fe2-b398-1c1231e75858", "value": 211760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772398631, "uuid": "2ca1bac1-b2aa-4da6-9462-cb1bb6866611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772398631, "uuid": "dc002889-5c45-481a-8432-7c4da72e0745", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd955089-157c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772376199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376199, "uuid": "11d7b69e-9eea-4e94-b85b-fe890f1165f9", "comment": "Malware payload (Mirai)", "value": "04d37f5297a95f57183d338fc83196c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376199, "uuid": "f6c039eb-fa9c-4215-a2e5-baa46d066d7f", "comment": "Malware payload (Mirai)", "value": "eb8b9c919cece229e8052ba0c3c8911da1a8a0fb3051c92e8450a65a5f00ba55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376199, "uuid": "e8476e14-d420-4535-8730-3f320686bf5c", "comment": "Malware payload (Mirai)", "value": "b0738eed57f0c57e9ef23bb36256afef5804d3e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376199, "uuid": "5b5458e5-8a6c-4c57-b43b-c8a26d1bb4ff", "comment": "Malware payload (Mirai)", "value": "198a2bf76598cff2494b57974cac48a978af4f6541b5b706d5c11d28371b22e354e5b97a9aa2d3b40eb16d9c35ccabb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376199, "uuid": "2f19ada3-b217-424c-9675-1b6cdd7b4cd5", "value": "T10ED34A63DD26AF4AC112A1F0B1F18E795B53FD2688571FBA6872EAE04143DCCB5063B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376199, "uuid": "2f6a770d-8957-458b-af3f-a044b9f175de", "value": "3072:yrnnIYP1O57S31GqtHlPniPzUWQ2ACaLquSnU:yre7YtHJGzNQDCqquSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376199, "uuid": "62295b5d-814d-4d33-9b05-15a15086d54c", "value": 134860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376199, "uuid": "dc15017d-0800-4562-8a18-1aa79240db72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376199, "uuid": "6c2398ef-5008-4d0f-9a98-06fbdc211f9f", "value": "nsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4415522-1579-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772374842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374842, "uuid": "f5c42a4e-071f-48f8-b75f-b5b19f809bb7", "comment": "Malware payload", "value": "664338ca370b59701d3621fbd73429b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374842, "uuid": "a65a6b38-0afe-4fc0-be63-975a561ff2d8", "comment": "Malware payload", "value": "ec4dc86bc4ed8cd3da3c83327a7bf1ef5421a4e6911cb549d39dbe312e70f770", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374842, "uuid": "ad505093-0359-4b54-a4a8-042583f4398f", "comment": "Malware payload", "value": "a92694aa9365e13610384952f122f69a22f4ad13", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772374842, "uuid": "77bf6c0c-7839-4041-9e94-6833051b7035", "comment": "Malware payload", "value": "912ec8168ce689474c60ec8c781dacbc829a0e8db1da2a8044d96080d0930c3f3b6f5329d076f9978d2848301bc519b0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374842, "uuid": "c2a47837-c887-41b6-b7e9-21ce45e6f548", "value": "T1B1F07DD595417C2D2630DC0FC3D07F06823146E2BD08661AE5E6CAC30EAACC2764FAA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374842, "uuid": "e849cf19-8691-405e-8a84-83d6f9b68210", "value": "12:8q0HsOt1VvhsRGBAsZQ4GjLYbZT4kYV0VyVIVs6X:8RHsOt1xhmGGs7Gj8OJmYCS6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772374842, "uuid": "d7e61346-c410-4bb9-8587-fe97889a276c", "value": 609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772374842, "uuid": "77daf366-4b2c-4b14-8aff-3dee5623836b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772374842, "uuid": "191dbc82-9f07-4ef4-87e5-c7142ff1fe49", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91539b2e-1577-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772373870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373870, "uuid": "339473af-06b4-4e59-b72c-769db08ca23d", "comment": "Malware payload (Vidar)", "value": "e50b07f7f1143b50cfc58dee35662a92", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373870, "uuid": "acd93e7f-e74d-4d67-953b-755c49531d1f", "comment": "Malware payload (Vidar)", "value": "ec817f4d51386eff994e61445384d215ea48677a72ac4c91ddef733d0551f59e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373870, "uuid": "eb31f31f-9571-494a-81b2-62486746fee0", "comment": "Malware payload (Vidar)", "value": "a8ab396fd97959c933e110374443b03349087e53", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772373870, "uuid": "199961c3-065b-4448-b189-7e683bffd2d5", "comment": "Malware payload (Vidar)", "value": "639a012ee2dcec891961501a65b1236ca0e94d6165259c7a7568a33ad609cc02defa117c5c1f76088ddb65bc5f434943", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373870, "uuid": "2a7d0119-2b78-483d-9180-b1c28fb2bdce", "value": "T107A56A2BBCE408F6D06A637789B712817BB0FC180B3263D72E90B6782EB26D55D75705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373870, "uuid": "aa704498-eda9-4a8f-85b8-f339ca53697f", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373870, "uuid": "41fb33a9-e216-4eee-8a2a-655a9810ee98", "value": "49152:XVSD2UnwDW585Zle3EKJnnnnqQvTWgop01D+xtVUvHg:XVvAwef0KJnnnnqQvro6D+XVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772373870, "uuid": "c67a653b-071f-4eeb-bcdf-73a2277fd0c7", "value": 2169856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772373870, "uuid": "993f5b11-00e1-4756-8ba4-f97925bfc726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772373870, "uuid": "7b0916b7-ba95-4c16-9a7f-4603702d5179", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d96a5fc-1511-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772329841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329841, "uuid": "c02b8474-ded7-4f27-b732-f3e9ee396f0e", "comment": "Malware payload (Mirai)", "value": "922d9173491f9d948502fb0dc8f66025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329841, "uuid": "4c126d06-297f-41d7-aa77-0349558850d6", "comment": "Malware payload (Mirai)", "value": "f10be4b2031dee06410180daa7f6df8469f0b2ed1dbd71139ea538e3eae76a0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329841, "uuid": "82b0d215-a9db-4bd3-a93d-2e01a42f3626", "comment": "Malware payload (Mirai)", "value": "58ac5ff77ff8a3772c03efbbf3c3f274ad817d1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772329841, "uuid": "f2fb4c84-1fa3-4bd7-8b04-09367606fb01", "comment": "Malware payload (Mirai)", "value": "db6b6700ac2e244e201d8c86a61b614afcdc38b946ade70bd33b319fccc3b0fc8001bd698afbc121d58adaf5f7d9748f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329841, "uuid": "196b1860-3921-4fa8-80e4-f387faff2a72", "value": "T1CC93D451BC82562BC5E423BAF6BE668D336577E5C2CF722BC8614B217B8551F0C63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329841, "uuid": "fe787929-eec5-425f-bd94-7df8b84b26e2", "value": "1536:4d+dOKCXt3/NDDkrw24WG1uLatp60EbrT9y3kZcBuA+bYQl:C+dQXt+r6g0OcBudFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772329841, "uuid": "e411dbcc-0800-4cf3-bd63-123394a1db64", "value": 93784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772329841, "uuid": "80dbd933-55eb-497f-9990-fa5da0b1c908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772329841, "uuid": "f64cb191-110c-4f52-84a5-90ca95e8f173", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6187c4ca-1550-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772357040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357040, "uuid": "2d3809e1-877c-4112-a3dd-7a72f126bed5", "comment": "Malware payload", "value": "2fa67f7aa702d3e629c7bfa1596a25d7", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357040, "uuid": "9b32ef4d-7765-4f42-b9ff-93cfb334370e", "comment": "Malware payload", "value": "f23940aef195cc494b4bda502e4cf1da9c138dd13ca5e6daa876649caf1d9c4d", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357040, "uuid": "88f3bc6f-958f-4a17-ab76-044584887b1d", "comment": "Malware payload", "value": "ab5a23ff3940d9c52f5bee62ea8c100614341ce3", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772357040, "uuid": "b4e381c4-f207-414f-b49d-c66eea972400", "comment": "Malware payload", "value": "2a0fe1cd7884d7f7e0ec8eb9436f28ed49ca1f38e73f1569a34f77f369fd5fdec0adb055d1b607b36ededb0f54394aee", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357040, "uuid": "03cc6f9e-a9db-4866-a3fc-5be860cacf6b", "value": "T1E5B01202EA8AC2E79401711D8294D961B883D4CEC113D5FDAF42871F21C7CE2418D1AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357040, "uuid": "48845bb7-2d0b-427a-aab2-eae23ccd8bc4", "value": "3:HRAbABGQYm+KXOCRIPGETJL18PKgoHh6v:HRYFVmM7+IJL2ygahE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772357040, "uuid": "d8bba947-4ae6-4c4d-875d-eae3e78e5999", "value": 102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772357040, "uuid": "4e007391-e48f-44fe-b1af-48e2fc10bb43", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772357040, "uuid": "1cb37a75-9e91-4865-87d5-986352c7e9cf", "value": "Fac_2026_7326910817.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40324887-156e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772369869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369869, "uuid": "cc0da810-4638-4314-bbdc-a2372454372f", "comment": "Malware payload (AsyncRAT)", "value": "bf2beb052c54eae8edd6e469b84755a6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369869, "uuid": "d328a88a-d7a9-4bdc-b5f8-a440f966d537", "comment": "Malware payload (AsyncRAT)", "value": "f32c930048c1af364c4e5b7e224e1901c3798e01efcf0c78bf9e38d6bb986038", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369869, "uuid": "c077547a-98d1-4b7a-9dea-85b916386bea", "comment": "Malware payload (AsyncRAT)", "value": "275c51fefbd3b4ce479ca1fd0c6546d761274e5d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369869, "uuid": "4071a406-bbe2-42ab-a95d-ed680af50288", "comment": "Malware payload (AsyncRAT)", "value": "79d0623106fa2906f82cd07fd7482af2d6ec353ba333c14b24d9acbe1357624878e0999e9d3b6fbfb7bc4fdede6999ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369869, "uuid": "06e94dd3-4994-44e7-afbb-f756efa4794a", "value": "T166F25A0573E58665E1FD1BBD5C3686044372FA478D22DBAE2EC450AE1A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369869, "uuid": "fc7b3131-e3f4-4d5f-8df2-58f1db9bfbbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369869, "uuid": "175c429d-ddaa-434a-9806-0bb0f2864d32", "value": "384:XMTBmv31wg36FC4hOlE1bdcWOe7X093bayseHQxnC7O+WmlIuufGfrfC1GWWcEQ+:XiBmfqg36F5hx1hVYRbJwB+WW13Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369869, "uuid": "6722c864-95cf-4734-acff-e411a08fbbd5", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369869, "uuid": "c7ffb0f0-50d5-4209-a4a6-aa3eeaa02e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369869, "uuid": "536dc931-5b07-47a0-ada6-a8afc05f3167", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7c4b4b-151a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772334109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334109, "uuid": "b596a4cc-a03f-4bed-a8a6-46d68fce5da5", "comment": "Malware payload (Mirai)", "value": "ec6cca8ddda3b1d6c183a0e945aa5955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334109, "uuid": "d760575b-b9b6-476d-9e1b-92f06cf629b7", "comment": "Malware payload (Mirai)", "value": "f3a2aa787edbfbc232f116465a70353ef04666daa12f987af552e9f4aae93a07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334109, "uuid": "66434542-a1f5-4161-b880-69c7da73c3f9", "comment": "Malware payload (Mirai)", "value": "13d7a392908f8740a9b43da0cc8f636056e39f7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334109, "uuid": "4f45279b-50f9-47dd-9eb9-64d3e2f71ec1", "comment": "Malware payload (Mirai)", "value": "bb88adc742a041683b3a8bc5155830f714f76808e84b0f140522ff6ef23956f4ae199156b4a1babb4adcd476fb5063ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334109, "uuid": "55820de5-c2b2-48a5-a45f-f8f21703defa", "value": "T1CDE35E9AF402EE7EFC0BD57E44670E19F930A3A13243072A529BFDA3AD311965D16EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334109, "uuid": "bc66df29-1562-4270-a79c-1ab1f0081dcd", "value": "3072:leWy5tMmSxA/EYfaAoa5omILfhF9nD7j2NQX:AimSxAsCo40hF9z2NQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772334109, "uuid": "f4e3d344-bb4a-45d8-9d0f-5905609bea0a", "value": 146872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772334109, "uuid": "5e87eb05-cfd1-40e2-98c8-df93e82c2343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334109, "uuid": "e71c48a9-2ede-4f43-aae3-1c3c852e3f93", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522b1644-1586-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772380207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772380207, "uuid": "afdeb253-6ede-4db1-9230-0d3184db4789", "comment": "Malware payload (ValleyRAT)", "value": "d69a08904de1312d8aaa2daae20f939c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772380207, "uuid": "ed89b8b2-8186-41a0-9562-bab3113088f7", "comment": "Malware payload (ValleyRAT)", "value": "f4c5d60c27d9cb4a45574151e9bc57786a044f44d990f92ea3930fe980d62650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772380207, "uuid": "8b6d30e9-17be-4d83-aa3b-74f39105d2eb", "comment": "Malware payload (ValleyRAT)", "value": "d1f46cd975de101ba2845642c90cdf336384e1cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772380207, "uuid": "c1a88c26-073d-4efe-a689-1a4bcc35e7be", "comment": "Malware payload (ValleyRAT)", "value": "75627fde7e586f56dfe51341e6c0165b649a46c46e37ffe6797bb9742a7ccef61134ab490e66a3864bee2e3e0fc935fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772380207, "uuid": "3f9605d6-1da7-4fdc-8574-e4ee933a6ae7", "value": "T181F40202B98598B2C6712D3512396B54693C7C202F209FDBE3D48AADEA741D0E735FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772380207, "uuid": "b952fbfe-3d7a-482e-94ca-6fc10ec8c324", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772380207, "uuid": "551e97a2-43a4-4533-82d6-65ee0765d29a", "value": "12288:9NpszYhvXWSVJdMaenqlJRwwxMRzNN+pudqwKSA83Hb08UqT6wv5EDvBDw5khZEM:DhvJVJdMWNwwONN+pIq7k70jqT6Q5EDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772380207, "uuid": "a9279b38-47de-4836-9567-ef023e86d57a", "value": 780066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772380207, "uuid": "4b71ed5e-b4de-4dac-8e3b-70596c8f7f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772380207, "uuid": "90ef7f16-c463-489e-9f73-6e28e85dedb7", "value": "f4c5d60c27d9cb4a45574151e9bc57786a044f44d990f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e64254-150e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772328803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328803, "uuid": "4cd85df3-e5fa-4df8-b448-3751b0a4ea29", "comment": "Malware payload (Mirai)", "value": "ca14590d6e67cfb67078cf3c9f9f92b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328803, "uuid": "919dbb93-097f-443e-9354-d5b44db015c4", "comment": "Malware payload (Mirai)", "value": "f59923efb819514495231b636f3acb3561d4b3758a9de5d125a2c5ab796ee29e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328803, "uuid": "16dd9d10-d6aa-47d6-b46b-5fa036958f41", "comment": "Malware payload (Mirai)", "value": "db08d0e4295b5d2080dbf14e7ad9f31fd9588341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772328803, "uuid": "3424aab4-3784-445b-85d6-b0bfaa0bbc2e", "comment": "Malware payload (Mirai)", "value": "cdc3928199d9dc2ec51bc700eafcb23c5e5eac49c8a8ba6f62dbf917f8adf20a16889bf820ce20ee0170d1df8b9ca84c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328803, "uuid": "c831ffc1-c1fb-4095-8c17-e0aa0e38c5b9", "value": "T10043D709EFA50EABC8AFCD3346A80F0635DC284712B43F297574D528B75A68756E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328803, "uuid": "a5cb93cb-39f4-44f4-9646-16281223954e", "value": "768:LZDcukg+2c5UPhgyl7wdz5K9ZakiXivTe4ONeweOLrHrI5:LGukmPho1mZakT9ONVhLHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772328803, "uuid": "b45fbbfb-2e88-44c0-8746-6baf80ce466a", "value": 55812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772328803, "uuid": "a47bd4d1-b799-4ccb-9bd9-2389dab0a566", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772328803, "uuid": "1b697ee1-b442-4d28-9a31-e457be12c712", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37da1c38-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1772376297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376297, "uuid": "7ec93d4c-2b06-4e21-88d4-b8a9d0b57ab5", "comment": "Malware payload (Cobalt Strike)", "value": "e85f68ddabaec658abf9d682edf06dda", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376297, "uuid": "8b56cc4c-90cf-4637-aa39-9d197850b2e3", "comment": "Malware payload (Cobalt Strike)", "value": "f654dd05e0a4b7c604f95160b8f7695883e70356fcb3c86ba6c6e4da30e26394", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376297, "uuid": "d4c30c59-b117-4851-980b-049bd3d64a97", "comment": "Malware payload (Cobalt Strike)", "value": "8b7833993e58fb573a62c06461c55741b8c2aeca", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376297, "uuid": "15e8f5ec-6007-4c66-ad19-d281dec3026b", "comment": "Malware payload (Cobalt Strike)", "value": "7eef7c0043540107613d8f5a8aa5e73ae6c1526cabeeb23cc94c06ee03c590394d51d403f19badc94ab4f046b1d1d1d9", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376297, "uuid": "bbc04119-42de-474b-b99c-5b3a2f310356", "value": "T13F556A1BBC9004F9D0AA52334DA6A4917B71BC490F3227D32EA0B67C2FBB6D59E74714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376297, "uuid": "554a5150-86a3-482e-bca3-c28dbc51b0ac", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376297, "uuid": "ada32f45-2720-490f-8067-20a14e0fdb8f", "value": "12288:yCxnwHVCnrbOq3ZrMVHSbUCF+DeZ957pHB4okuKhE8V4vT4MJgjjaccgZItPJp4r:yCWCrbOq3ZYVCU0+QD7pHyU+xWtPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376297, "uuid": "677494f0-2288-43c6-907e-d71bd5fdd62d", "value": 1375232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376297, "uuid": "2f8ff73b-9c91-4b41-aab6-8f7bcc6b01c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376297, "uuid": "f20ee032-d890-47dc-a012-2b36bcc6d12a", "value": "f654dd05e0a4b7c604f95160b8f7695883e70356fcb3c86ba6c6e4da30e26394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc69ac12-1570-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1772370990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370990, "uuid": "bea37f98-9765-4566-b56f-9e037aa78849", "comment": "Malware payload (Amadey)", "value": "c274f4ad76b6736b3af28c9963a38d2d", "object_relation": "md5", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370990, "uuid": "3176d288-0d67-4bbf-a87b-b3e9ff3fc992", "comment": "Malware payload (Amadey)", "value": "f752fec648a3cb916e0e06a1435d9572c0a923a067067f81e1322a6afbc01dcb", "object_relation": "sha256", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370990, "uuid": "e928c829-1a03-4d08-9b0b-6c76120bbad3", "comment": "Malware payload (Amadey)", "value": "0101b408128ba5b8bdc9c437abce98e49edff4a2", "object_relation": "sha1", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772370990, "uuid": "e7f07642-9737-4c71-8df2-e6454a5d49b0", "comment": "Malware payload (Amadey)", "value": "33c997906372fa27714c71ed2023d934da8c7b92b497225a0d21e02e857eb48799dc5ae5467489b67177470f2b301cbc", "object_relation": "sha3-384", "Tag": [ { "name": "62-60-226-5", "colour": "#CE50E6", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370990, "uuid": "9ec6be08-d8e4-4940-bf40-8a6c8c199bc8", "value": "T12B76AF0373C40DF9C02A967442265372D263FC756FA4DC9B5EC5FA4A8E3A7918D3AE21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370990, "uuid": "bbe24eb2-8018-47ce-9ffb-1b6e7ff95daf", "value": "3ebc6615ee6e83e349ea34fde3fe4d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370990, "uuid": "49ac7ba9-5b1c-404a-b849-74d504708b1a", "value": "196608:fWtEf94ogYPllFuWKkHXWo00OW5w8FQ7NJIoIGeSUnlzUe+EV7DQGul5S:OOf9kYPlDHDOWW+Q7NeD9ie+AQGul5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772370990, "uuid": "65be2189-8b4f-41c9-bef9-8f9e188a9f05", "value": 7223296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772370990, "uuid": "5af800f9-37fa-48c6-ae44-9c1d6cf949e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772370990, "uuid": "cea9cbd2-db9f-4444-95ad-5fcbf39207e9", "value": "vsdbg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31126d90-157d-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1772376286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376286, "uuid": "e2bf1e48-4d6a-4666-8827-9feec9a46336", "comment": "Malware payload (Cobalt Strike)", "value": "e25cba8f1fc163857141acb76e4916ce", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376286, "uuid": "704395e9-6fe8-49a2-b4c4-0ff50518a776", "comment": "Malware payload (Cobalt Strike)", "value": "f77d9073f461ce158971e66bd0dbec3273aba6c24fb3e8fe2ba4998dd7b59468", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376286, "uuid": "1ae62a01-fec4-47e9-a3b2-82b17f415851", "comment": "Malware payload (Cobalt Strike)", "value": "2d10be69ddab45a72d683cb933cac549a9a48c1e", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772376286, "uuid": "3f88576f-1620-4997-bd1f-3b52aba6b60c", "comment": "Malware payload (Cobalt Strike)", "value": "7ff6eb97990a3d1c877579a871cea32c699df6dfef5d9211ad64275a470905d284cd708bbeb6c36d68e76000a76ee13a", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376286, "uuid": "fe3523bc-ed82-4d00-b982-367f1b122546", "value": "T19D555B1BBDA408F6C06A52328C66A191BB71BC450F3123C72EA0B6BC2FB77D49D75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376286, "uuid": "2e5f97a9-1645-4401-b1d1-4eb09ad18603", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376286, "uuid": "e53ce7e0-0433-42c3-aa94-30c5a0046f8c", "value": "12288:qmWIqltttuDa1eq/nKQW2FmsdRpH6/4BnZpqfy45T+MJgjjaccgZItPJp4wCPO7Y:qlntttuDasq5W2YqpH8yp5xWtPmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772376286, "uuid": "9fb5330a-3a5c-4daf-87a0-0cb9bb0fa77f", "value": 1381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772376286, "uuid": "6363f780-4ad8-434a-bd40-550e746cf355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772376286, "uuid": "1019b755-285e-4511-800e-98a29f953cda", "value": "f77d9073f461ce158971e66bd0dbec3273aba6c24fb3e8fe2ba4998dd7b59468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f6f4e2-1563-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772365372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365372, "uuid": "1ce1e84a-1ca3-4fd2-8df1-6100d318ae84", "comment": "Malware payload", "value": "6ae497e1b1ba531753fa111520f215b6", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365372, "uuid": "12a42d70-8bb0-4727-b243-9f917c6f0a8a", "comment": "Malware payload", "value": "f81e70c6951855e27ea34f60a6a32e55148a3a09dea84a3feacbeb649357ceee", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365372, "uuid": "a5dfbf2c-46d9-492a-9ccb-92eb73ee1fe2", "comment": "Malware payload", "value": "e272b1abcdfc65f38799dc0064694dc9b0a6d055", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772365372, "uuid": "c41fe09e-3e1c-44a9-b305-1c3ee5ba1117", "comment": "Malware payload", "value": "97ee422a406d0bdcfabc5df2bba5b3312ea0e738798f3b06a39dad18e954764a2b068cad58261e2a68ae64e345d07280", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365372, "uuid": "0764aaed-0c3a-46d8-8060-568d969fe224", "value": "T153854F74F6E52CE6E5087147370934D7A492F3028BD07CAD0269D6F7E7F1AB6821B286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365372, "uuid": "d76c72ab-c3b8-40ce-95f7-f84d480600d7", "value": "6144:fm1rI2QHBJLHY1cMNkei0evKSgWH8940PYM30+FzW4CUCkXdwUo05bK:fC2L41cMHeK/l4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772365372, "uuid": "df03115e-df05-4ab5-b3d0-574c94b22f70", "value": 1766114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772365372, "uuid": "5192d76d-70cf-4306-ac13-a117c84c34fc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772365372, "uuid": "36081090-0707-41d0-a100-aea373acee00", "value": "1_1_.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd16fa50-15ac-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396707, "uuid": "c7a2b11c-28bd-41f6-ad18-3fd84247ca3a", "comment": "Malware payload (Mirai)", "value": "eab484999e0d3098654a8ecf83950fc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396707, "uuid": "0c02088a-deeb-4be9-a1db-301b6cca0fef", "comment": "Malware payload (Mirai)", "value": "f83dd3dffc07f9deca8faeee85d92e1ee4cfa5bf9f089b5448cfb657239e5758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396707, "uuid": "a51b9977-0c38-46e6-853b-7e67f62739af", "comment": "Malware payload (Mirai)", "value": "6238a96132193e16612f63c60151a4b13c9846ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396707, "uuid": "f6728488-b56c-497b-a056-7653a361db24", "comment": "Malware payload (Mirai)", "value": "6a9ab943cec38a190765c66d5c4f3fa706ceb042ab6474657c3c1a7b9cff756c894c351c538afabbc8fde3631ef8ee9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396707, "uuid": "46729d22-90bf-4320-8d20-02f426c68a0b", "value": "T1EFF36C0779D180FDC8DAC2744BAFA236DA72F4496135721F23C46E2A2E5DF206B6DB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396707, "uuid": "23d1054d-ad49-4181-b0f5-79f66bdeb49d", "value": "3072:vahjzJ11FH9nsTvzaU1O1KaSfZVCx6tJ4afRM1m0gE9:I9nSwvvaSuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396707, "uuid": "a00db8cc-f57b-4277-861f-8b2b76fc283a", "value": 164272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396707, "uuid": "ab52335f-66bf-4e4f-9d69-50b7366a3ed6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396707, "uuid": "f4323b07-29be-4f9b-9a72-0a1ab982bb3e", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358aaadd-151c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772334632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334632, "uuid": "ce7cfdda-397b-4e75-a732-ef0cb60a3ea0", "comment": "Malware payload (Mirai)", "value": "56b955013e76d10370139407dea4fec0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334632, "uuid": "c1bb831d-fcd8-4ec1-bea8-1d23983254bc", "comment": "Malware payload (Mirai)", "value": "f893677414d3e535739934646d783958e1f54d7c25efb9181f5d853f24e41be5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334632, "uuid": "06ab93b8-1106-4fe5-8160-19bf278b7086", "comment": "Malware payload (Mirai)", "value": "e4ab2559695ae14c8d14f7b8f08eb4517c13c265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772334632, "uuid": "0cd962c5-dc6a-456d-a481-b968acf5caa7", "comment": "Malware payload (Mirai)", "value": "2d4c32da638cba9112bab38413eed4f76b4a68c3a668d57831cea34bf4d0fba7ace3330f47f1c5ceb3b5ee21dbf511a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334632, "uuid": "8e0494f2-ccf6-4725-bd35-6edbafd78692", "value": "T1DEB339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334632, "uuid": "c76b399d-9987-4c7a-a970-23ca391772d3", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wezSr9bMFflJ:Pbj4doYGFB0/45gdG9ulJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772334632, "uuid": "962f8037-5062-4e88-a8d9-f1cde9077e21", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772334632, "uuid": "01fea481-087b-4857-b955-a9a4b26d9583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772334632, "uuid": "af1e7ef6-2049-4be4-968e-2c7c6df32d0c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a884435-155d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772362585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362585, "uuid": "5dabf2de-9973-44db-a239-1f4564914af5", "comment": "Malware payload", "value": "c2e101d3fba4a09311c1bf8532708993", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362585, "uuid": "0a14e96d-93ae-47c7-a1e7-80b2a943b0ac", "comment": "Malware payload", "value": "f92f9d0f9a9470206a1b9f0bb452e82bb511637ccf735bb9e365168229fba95d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362585, "uuid": "e183ebe7-ffcd-4e04-baf1-eb49e736d860", "comment": "Malware payload", "value": "6d3435617c755c5d7629b33ef36e6dc647c0edd9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772362585, "uuid": "8150be42-0601-4057-a007-9d6a0d86a235", "comment": "Malware payload", "value": "d49cf7860b5fa99321d6f61be29fd4a2d764bc31e3d97b58e016fb19800ae205a85bc908c6946407857e266b3f3ed123", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362585, "uuid": "b3c9627f-9f6a-4926-b4b1-208c668c2cf2", "value": "T18853F14271068332D84286364B6FAFD14B746C55AF7B2A4235D7BB9C2E759D01AF3EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362585, "uuid": "472416e2-b2da-4e28-9b45-b38b18551740", "value": "1536:P3fcyB6ZsGuj38DS3ZRXbmFGtRdFhafuo8NLob2z:ncyB6Mj3JZ8FGtRtaWzNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772362585, "uuid": "7c7ec87d-6920-4eb5-b2bd-1bad4efef292", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772362585, "uuid": "c8ec5e7e-ac1c-4285-afa1-fcbc0987f317", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772362585, "uuid": "b3921ffa-ad56-4f55-aa7f-9ed12964cc5d", "value": "cv.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413900b5-15ab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772396070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396070, "uuid": "0037a779-305b-4f49-b4ff-a853140f34a2", "comment": "Malware payload (Mirai)", "value": "b586beb3762ea3ca4e9497df036177ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396070, "uuid": "dce2d158-eb94-4cfd-8440-090ea477a854", "comment": "Malware payload (Mirai)", "value": "fa83d27c4d2cf70cafefc6c22d92940db2d07bd950515ae2aa4dacf623e91938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396070, "uuid": "04ab7c6c-07cb-4a93-ad2c-0fab764afbf4", "comment": "Malware payload (Mirai)", "value": "450b294f7bc262b848376051db2beca789a030bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772396070, "uuid": "1222d448-8897-44a8-8106-4e77e83452d0", "comment": "Malware payload (Mirai)", "value": "2e85237f8996d44660b08767803a788d2b3880d4bc3e95add59dd2590205af1c8ceb6f3cdf021c88a6d1fc203c60f531", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396070, "uuid": "525d4c8a-d2a0-4e69-94b0-ce786b676366", "value": "T14A156D5BB2A374FDC057C43043ABDAB2A935B42502226E7B65C8D7303E27E701B59B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396070, "uuid": "e533dcdc-f085-4138-9fb1-f2571b18ed18", "value": "24576:ass+14s2kWjDCgc5q+rtCiLFxJJC8T2kJ:Z34s2kWPzitTlhT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772396070, "uuid": "a3388624-18b2-4b24-8904-c359f5ff4867", "value": 898792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772396070, "uuid": "5978e5d6-d641-4823-b1f8-80827e36f882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772396070, "uuid": "0d4ef502-c54d-4f32-b558-77c515d62743", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11745bb7-156e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772369790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369790, "uuid": "b362568a-edeb-4476-9524-a7fc34b61b18", "comment": "Malware payload (AsyncRAT)", "value": "3dcd7023c1750e3a41cda4889bb8f3c2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369790, "uuid": "8b6c282e-cbab-464d-b21c-72112e4e4c34", "comment": "Malware payload (AsyncRAT)", "value": "fbed39b091e553dd542376bf6104c7435551d6ef7fbd7196cc23d1737eec9315", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369790, "uuid": "73027f0d-a9f7-496a-a726-0478a8227deb", "comment": "Malware payload (AsyncRAT)", "value": "4f3872263d104d13693305d0dc631d640282b5a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772369790, "uuid": "a08c018f-0281-4d2c-9aed-f31faf1de5d1", "comment": "Malware payload (AsyncRAT)", "value": "dfab715a318df7ddcadfdd73532720cd2df25842c1ce02146c4a112a41c5473d4348c17982b29719be0a00d4394bf15a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369790, "uuid": "43816f96-ec9b-48b8-b4d0-3766c8fcdf54", "value": "T1D4F24A0573E59665E1FD1BBD5C3686044372FA478D22DBAE2EC450AE1A237C8CF24BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369790, "uuid": "7b4a3426-f59d-41a5-93eb-8a9d05751ef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369790, "uuid": "8f7f4b8c-97b2-478f-be71-fa655c142879", "value": "384:IMTB2LD1mD+YR4hulE1bdcWOe7X093bayseHQxnC7O+WmlIuufGfrfCrSWWmNEQ+:IiB2fED+Y6hR1hVYRbJwB+WW3NQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772369790, "uuid": "3052394b-8f63-48e4-bbfc-4b0b5db178d6", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772369790, "uuid": "fccd3533-18f1-4f0e-9806-645fa0fbf706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772369790, "uuid": "27d10e83-bed9-4658-bd66-c187173efce5", "value": "MalwareRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae1c823-15a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772393643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393643, "uuid": "54dcc247-db98-4910-bede-5fa6eec535ac", "comment": "Malware payload (Mirai)", "value": "e85137a1dd4c5b81b43afbcd7fe181d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393643, "uuid": "fc5d6a76-1caa-4534-a23d-e77e7582b8ef", "comment": "Malware payload (Mirai)", "value": "fd0c20415259c6a67875850153272c1d3eed2ab6f12c3331617825269665f4a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393643, "uuid": "b6442039-29bd-4138-9e9b-aac5a1097fd0", "comment": "Malware payload (Mirai)", "value": "8c18dc5a9af3931150bca77194feebbdd1190958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772393643, "uuid": "a985b895-0277-4b81-a4a1-ea81a3512ef8", "comment": "Malware payload (Mirai)", "value": "cb634cbff15a38c55bef08831e37f1e416574f527ca9be78bc34140b0029592678ddd0a2c208fea80ab75717a9e5ef2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393643, "uuid": "6ab5a21a-a3ad-4648-b727-14c08952baf4", "value": "T17DE30659ED41AF10D5DA36FAFE4E428933534B6CE3FA7102DE245B2123CAA6B0F76501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393643, "uuid": "31114c58-7e46-42e5-a624-6102f2ff62df", "value": "3072:BTnKRk/sdkD4lnT7yVUGXzog734BcsImeCGkhra2ms7Kso5KErI/5l7oG1JrHkpg:NnKRk/sdhlnXyVrN73vsIMt5a2B7KsoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772393643, "uuid": "1a21be02-9a00-470b-b2a9-e22f714a2dac", "value": 149416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772393643, "uuid": "bbde00f2-184f-4bdb-be35-c8ca40a70722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772393643, "uuid": "a7b9363e-aa8f-45ef-9457-d2afd7d49456", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }